CVE-2026-65920 | Hugging Face diffusers up to 0.39.0 Model Loading _get_checkpoint_shard_files weight_map path traversal

A vulnerability classified as problematic was found in Hugging Face diffusers up to 0.39.0. The impacted element is the function _get_checkpoint_shard_files of the component Model Loading. Executing a manipulation of the argument weight_map can lead to path traversal.

The identification of this vulnerability is CVE-2026-65920. The attack may be launched remotely. There is no exploit available.

It is best practice to apply a patch to resolve this issue.