Hugging Face Transformers fails to validate shard filenames in checkpoint index files. Attackers can supply malicious index files containing parent-directory references or absolute paths that are joined without validation, allowing them to read arbitrary files outside the model directory. This path traversal flaw directly exposes sensitive files and enables filesystem reconnaissance, constituting a medium‑severity information disclosure weakness identified as CWE‑22.

All versions of the Hugging Face Transformers library are susceptible, as the vulnerability is present wherever checkpoint index files are processed. The issue affects the core Hugging Face Transformers package and has no limited version scope listed. Users deploying any model that relies on checkpoint indexing should consider the library as potentially affected.

The CVSS score of 6.8 reflects a moderate risk. No EPSS score is provided, and the vulnerability is not listed in CISA KEV, indicating that widespread exploitation is not currently documented. Attack feasibility depends on the attacker’s ability to supply a malicious checkpoint index file, for example by hosting a crafted model or compromising a model repository. If the model loading process trusts external checkpoints, the attack can reveal arbitrary files on the host filesystem, potentially exposing credentials or configuration data.