Threats Tagged 'cve-2026-75104'

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.

CVE-2026-75104 is a path traversal vulnerability in Hugging Face Transformers that allows attackers to read arbitrary files outside the intended model directory. This occurs because shard filenames in checkpoint index files are not properly validated, enabling malicious index files with parent-directory references or absolute paths to disclose files and perform filesystem reconnaissance. The vulnerability affects versions up to and including 5.15.0. The CVSS 4.0 score is 6.8, indicating a medium severity. No official patch or remediation guidance is currently available.