---
id: CVE-2026-75104
title: >-
  Hugging Face Transformers fails to validate shard filenames in checkpoint
  index files, allowing attackers to read arbitrary files outside the model
  directory
summary: >-
  Hugging Face Transformers fails to validate shard filenames in checkpoint
  index files, allowing attackers to read arbitrary files outside the model
  directory. Attackers can supply malicious index files with parent-directory
  references or…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: huggingface
product: transformers
affected:
  - transformers <= 5.15.0
published: '2026-08-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:02:50.260'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75104'
references:
  - url: 'https://github.com/huggingface/transformers'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/huggingface/transformers/blob/main/src/transformers/utils/hub.py
    label: disclosure@vulncheck.com
  - url: 'https://github.com/huggingface/transformers/issues/47176'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/huggingface/transformers/issues/47177'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/hugging-face-transformers-path-traversal-via-checkpoint-index
    label: disclosure@vulncheck.com
  - url: 'https://github.com/huggingface/transformers/issues/47176'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00286
epssPercentile: 0.18878
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-18T12:39:44.371007Z'
ingestedAt: '2026-09-24T15:45:56.704Z'
---

## Overview

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.