CVE-2026-65920

MediumCVSS 4.3/10Last modified Oct 24, 2026

Description

Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying malicious weight_map values in model index JSON. Attackers can use ../ sequences or absolute paths in weight_map entries to escape the model directory and read safetensors files outside the intended location during model loading.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jul 23, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-659218.8A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended bCVE-2026-659225.4An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restCVE-2026-659236.8A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, CVE-2026-659246.5JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticaCVE-2026-659256.5A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.CVE-2026-659263.1An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versCVE-2026-659277.5Off-by-one Error vulnerability in Apache Tomcat impacting the [N] flag on the rewrite valves causes rewrite processing to restart at the secCVE-2026-65933.5A vulnerability was found in ComfyUI up to 0.13.0. Affected by this issue is some unknown functionality of the file server.py of the componeCVE-2026-659304.8LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog usedCVE-2026-659315.1LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpointCVE-2026-659325.3The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service. See vuCVE-2026-659335.3A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in th