{"id":"CVE-2025-65713","aliases":["GHSA-pp3g-xmm4-5cw9","PYSEC-2026-1454"],"title":"Home Assistant Core before is vulnerable to Directory Traversal","summary":"Home Assistant Core before is vulnerable to Directory Traversal","severity":"medium","vendor":"homeassistant","product":"homeassistant","ecosystem":"pip","affected":["homeassistant < 2025.8.0"],"patched":["homeassistant 2025.8.0"],"published":"2025-12-23","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-pp3g-xmm4-5cw9","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65713"},{"url":"https://github.com/home-assistant/core/pull/150046"},{"url":"https://gist.github.com/GenoWang/7359360285e0fe21a7a58d10ff71d032"},{"url":"https://github.com/home-assistant/core"},{"url":"https://github.com/home-assistant/core/blob/a4d12694dae82f10e2ca9c524e44a22ab7dacf66/homeassistant/components/downloader/services.py#L32"},{"url":"https://github.com/home-assistant/core/blob/a4d12694dae82f10e2ca9c524e44a22ab7dacf66/homeassistant/util/__init__.py#L20"},{"url":"https://github.com/home-assistant/core/blob/a4d12694dae82f10e2ca9c524e44a22ab7dacf66/homeassistant/util/__init__.py#L32-L38"}],"tags":["osv","pip"],"epss":0.00405,"epssPercentile":0.34427,"ingestedAt":"2026-07-08T18:25:51.813Z","slug":"CVE-2025-65713","body":"## Overview\n\nHome Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability.\n\n## Affected packages\n\n- `homeassistant < 2025.8.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `homeassistant 2025.8.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}