The vulnerability exists in the Diffusers library when the function that locates checkpoint shard files allows the weight_map field of a model’s index JSON to contain path traversal sequences or absolute paths. This flaw lets an attacker cause the loader to read any file accessible to the process, resulting in an arbitrary file read that can expose configuration files, secrets, or other sensitive data. The weakness is a classic path traversal (CWE-22).

Vendors: Hugging Face. Product: Diffusers library for Python. Versions up to 0.39.0 are affected. The issue was fixed by commit cee298c1f37c439a9a408396b8283a921238a1c6, which validates weight_map entries and restricts file access to the model directory. Clients using earlier releases should upgrade to the patched version.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is under 1%, implying a low likelihood of exploitation as of now, and the vulnerability is not listed in CISA KEV. Likely, the attacker must supply a malicious model index file containing crafted weight_map entries during model download or loading to exploit the vulnerability. Because the loader runs with the same privileges as the application, the extent of data exposure depends on process privileges. The flaw can be local or remote depending on how the model file is acquired, but only a process that can write arbitrary model files can exploit it.