HACS version 1.10.0 contains a path traversal flaw that lets an unauthenticated attacker read arbitrary files via the /hacsfiles/ endpoint. The vulnerability is exploited to read the .storage/auth file, which stores user credentials and refresh tokens. With these tokens an attacker can forge valid JWT tokens and obtain administrative access to a Home Assistant instance, effectively hijacking the account. This exploits CWE‑22 path traversal and results in privileged account compromise.

The vulnerability affects Home Assistant’s Community Store integration, specifically HACS 1.10.0 and earlier releases that have not yet applied the fix. Systems running Home Assistant with HACS enabled and exposing the /hacsfiles/ endpoint are at risk.

The CVSS score of 8.7 indicates a high severity. Because the flaw does not require authentication and can be triggered by a simple HTTP request, the risk of exploitation is significant. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but given the low complexity attack vector and the critical nature of the compromised resource, administrators should treat it as immediately exploitable.