CVE-2026-69112: Hugging Face Accelerate Path Traversal Lets Attackers Read Arbitrary Files
Originally published at HOL CVE-2026-69112: Hugging Face Accelerate Path Traversal Lets Attackers Read Arbitrary Files from Checkpoint Indexes TL;DR: Hugging Face Accelerate through version 1.14.0 fails to sanitize weight_map entries in sharded checkpoint indexes. An attacker who controls a checkpoint index file can supply relative paths with parent-directory traversal sequences or absolute paths…
Hugging Face Accelerate, a popular library for distributed training and inference in PyTorch-based machine learning workflows, has a critical vulnerability (CVE-2026-69112) that allows attackers to read arbitrary files from the system. The issue lies in the library's handling of sharded model checkpoints, which uses index files containing tensor name to filename mappings.
Attackers can manipulate the weight_map entries in these index files to include relative paths with parent-directory traversal sequences or absolute paths, causing Accelerate to open unauthorized files. The vulnerability affects all versions up to 1.14.0 and is prevalent in thousands of ML pipelines. To mitigate the risk, users should validate checkpoint index files before passing them to the library's loading functions, rejecting any paths that contain ".." or start with "/".
Additionally, checking that weight_map entries are not named pipes can prevent indefinite blocking and denial of service. Until a patched release becomes available, these validation steps are crucial to prevent unauthorized file access and potential data exfiltration.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
