HACS prior to 1.10.0 contains a path traversal flaw that lets an unauthenticated attacker read arbitrary files via the /hacsfiles/ endpoint. The vulnerability is exploited to read the .storage/auth file, which stores user credentials and refresh tokens. With these tokens an attacker can forge valid JWT tokens and obtain administrative access to a Home Assistant instance, effectively hijacking the account. This exploits CWE‑22 path traversal and results in privileged account compromise.

The vulnerability affects Home Assistant’s Community Store integration, specifically HACS prior to 1.10.0 that have not yet applied the fix. Systems running Home Assistant with HACS enabled and exposing the /hacsfiles/ endpoint are at risk.

The CVSS score of 8.7 indicates a high potential impact if exploited. However, the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability allows an unauthenticated attacker to read sensitive files via the /hacsfiles/ endpoint, retrieve the .storage/auth file containing credentials, and craft JWT tokens to gain administrative access. While the security impact is severe, the low exploitation probability means that administrators should promptly apply the fix but can also monitor for suspicious activity. The vulnerability is not listed in the CISA KEV catalog.