CVE-2026-66007CWE-22path-traversal

CVE-2026-66007

Medium · published July 24, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00550 · 45.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-24T19:19Z
Affected products (1)
ProductVersionsFixed in
huggingface/datasets≤ 5.0.0—
References (4)
https://github.com/huggingface/datasets/commit/f989ef9b4cc6c0039a7a82458eebca49e2b58b4b · [email protected]https://github.com/huggingface/datasets/issues/8324 · [email protected]https://github.com/huggingface/datasets/pull/8325 · [email protected]https://www.vulncheck.com/advisories/datasets-path-traversal-via-unsanitized-file-name-metadata · [email protected]
EPSS history
Timeline
  • 24 JUL 14:58Z
    Datasets Path Traversal via Unsanitized file_name Metadata
    cvelistv5