CVE-2026-75104: Hugging Face Transformers File Disclosure

CVE-2026-75104 Overview

CVE-2026-75104 is a path traversal vulnerability [CWE-22] in the Hugging Face Transformers library. The library fails to validate shard filenames listed inside checkpoint index files. When Transformers loads a sharded model, it joins the attacker-controlled filename with the model directory path without sanitization. Attackers supply malicious index files containing parent-directory references (../) or absolute paths, causing the loader to read files outside the intended model directory. The result is arbitrary file disclosure and filesystem reconnaissance on the host running the model load.

Critical Impact
Arbitrary local file read through crafted checkpoint index files, exposing secrets, keys, and configuration data accessible to the process loading the model.

Affected Products

Hugging Face Transformers (checkpoint index loading path in src/transformers/utils/hub.py)
Applications and services that load third-party or user-supplied model checkpoints via Transformers
ML pipelines consuming untrusted models from public or internal registries

Discovery Timeline

2026-08-17 - CVE-2026-75104 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75104

Vulnerability Analysis

Hugging Face Transformers supports sharded checkpoints where model weights span multiple files. A JSON index file such as model.safetensors.index.json or pytorch_model.bin.index.json maps tensor names to shard filenames. During model loading, Transformers reads this index, iterates the referenced shard filenames, and joins each entry with the model directory path before opening the file. The loader treats the index contents as trusted metadata and performs no normalization or containment check against the base directory.

An attacker who publishes or ships a malicious model can place entries like ../../../../etc/passwd or absolute paths into the index. When a victim loads the model with from_pretrained, Transformers opens those paths in the context of the user process. Because loading a model is a common, low-friction action for ML developers and services, the vulnerability enables information disclosure with minimal user interaction beyond the standard model-loading flow.

Root Cause

The root cause is missing validation of shard filenames read from the checkpoint index. The affected code in hub.py performs a path join without verifying that the resolved path stays within the model directory, and without rejecting absolute paths or parent-directory traversal sequences. This is a canonical [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires a victim to load an attacker-controlled model repository or archive. The attacker crafts an index JSON containing traversal sequences in the weight_map values. When from_pretrained processes the index, the library reads files outside the model directory and, depending on downstream handling, may surface their contents through errors, telemetry, or attacker-observable side channels. See the VulnCheck Path Traversal Advisory and the upstream reports in GitHub Issue #47176 and GitHub Issue #47177 for technical details.

// Vulnerability described in prose - no verified PoC code available.
// See the VulnCheck advisory and upstream GitHub issues for reproduction details.

Detection Methods for CVE-2026-75104

Indicators of Compromise

Checkpoint index files (*.index.json) containing ../ sequences, backslash traversal, or absolute paths in weight_map values
Model directories where referenced shard filenames resolve outside the repository root
Unexpected file-open events on sensitive paths (/etc/, ~/.ssh/, cloud credential files) originating from Python processes running Transformers

Detection Strategies

Statically scan model repositories and cached artifacts for index files whose weight_map values are not simple basenames matching ^[A-Za-z0-9._-]+$
Instrument model-loading code to log resolved absolute paths for every shard read, and alert when the resolved path escapes the model directory
Review process telemetry for Python interpreters reading files outside expected model, cache, and dataset directories immediately after from_pretrained calls

Monitoring Recommendations

Track file-access events from ML workload processes and baseline expected model and cache directory paths
Monitor outbound traffic and error logs from model-serving services for leaked file contents after loading third-party models
Alert on new or updated *.index.json files in shared model stores and require review before promotion to production

How to Mitigate CVE-2026-75104

Immediate Actions Required

Upgrade Hugging Face Transformers to a release that validates shard filenames in checkpoint index files once available; track fixes referenced in GitHub Issue #47176 and GitHub Issue #47177
Restrict model loading to trusted, internally vetted repositories and disable automatic pulls from unvetted Hugging Face Hub sources
Audit existing model caches for index files containing traversal sequences and remove any offending artifacts

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Monitor the Hugging Face Transformers repository and the VulnCheck advisory for the fix commit and released version. Apply the update across all ML training, evaluation, and serving hosts.

Workarounds

Run model loading inside a sandbox (container with read-only root filesystem, seccomp, or a minimal chroot) so that arbitrary reads cannot reach sensitive host files
Pre-validate downloaded model archives by parsing index JSON and rejecting any weight_map value that is absolute or contains ..
Load untrusted models only under a low-privilege service account with no access to secrets, SSH keys, or cloud credential files

bash

# Pre-flight check: reject index files with traversal or absolute paths
python - <<'PY'
import json, os, sys
for root, _, files in os.walk(sys.argv[1]):
    for f in files:
        if f.endswith('.index.json'):
            data = json.load(open(os.path.join(root, f)))
            for name in set((data.get('weight_map') or {}).values()):
                if os.path.isabs(name) or '..' in name.replace('\\\\','/').split('/'):
                    print('UNSAFE:', os.path.join(root, f), '->', name)
                    sys.exit(1)
print('OK')
PY