CVE-2021-47942CWE-22

Home Assistant Community Store 1.10.0 Path Traversal Account Takeover

High · published May 16, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
41.7
In the wild
Unconfirmed
What it is

Home Assistant Community Store (HACS) prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh tokens, then craft valid JWT tokens to gain administrative access to Home Assistant instances.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00498 · 41.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-16T15:28Z
EPSS history
Timeline
  • 16 MAY 15:28Z
    Home Assistant Community Store 1.10.0 Path Traversal Account Takeover
    cvelistv5