CVE-2026-65920 is a path traversal vulnerability in the huggingface diffusers library up to version 0.39.0. The vulnerability resides in the _get_checkpoint_shard_files function, where attackers can supply malicious weight_map entries in the model index JSON. These entries can include ../ sequences or absolute paths, allowing traversal outside the intended directory and reading of arbitrary safetensors files during model loading. This could lead to unauthorized disclosure of files accessible to the application. The vulnerability is fixed in a commit identified as cee298c.

An attacker can read arbitrary files on the system accessible to the application by exploiting the path traversal vulnerability in the diffusers library. This may lead to unauthorized disclosure of sensitive information contained in files outside the intended model directory. There is no indication of privilege escalation, code execution, or other impacts beyond information disclosure. The CVSS 4.0 base score is 5.3, indicating a medium severity vulnerability with network attack vector, low complexity, no privileges required, and user interaction needed.

A fix for this vulnerability is available in the huggingface diffusers project, implemented in commit cee298c. Users should upgrade to a version that includes this commit or apply the patch directly to remediate the issue. No vendor advisory content is provided to confirm the exact fixed version number, so users should consult the official huggingface diffusers repository for the patched release. Until patched, avoid loading untrusted model index JSON files that could contain malicious weight_map entries.