---
id: CVE-2026-75104
title: >-
  Hugging Face Transformers fails to validate shard filenames in checkpoint
  index files, allowing attackers to read arbitrary files outside the model
  directory
summary: >-
  Hugging Face Transformers fails to validate shard filenames in checkpoint
  index files, allowing attackers to read arbitrary files outside the model
  directory. Attackers can supply malicious index files with parent-directory
  references or…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
vendor: huggingface
product: transformers
affected:
  - transformers <= 5.15.0
published: '2026-08-17'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:02:50.260'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75104'
references:
  - url: 'https://github.com/huggingface/transformers'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/huggingface/transformers/blob/main/src/transformers/utils/hub.py
    label: disclosure@vulncheck.com
  - url: 'https://github.com/huggingface/transformers/issues/47176'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/huggingface/transformers/issues/47177'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/hugging-face-transformers-path-traversal-via-checkpoint-index
    label: disclosure@vulncheck.com
  - url: 'https://github.com/huggingface/transformers/issues/47176'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75104.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-75104'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2517610'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-75104'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75104'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
epss: 0.00286
epssPercentile: 0.21042
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-18T12:39:44.371007Z'
ingestedAt: '2026-09-24T15:45:56.704Z'
---

## Overview

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Attackers can supply malicious index files with parent-directory references or absolute paths that are joined without validation, enabling file disclosure and filesystem reconnaissance.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Lightspeed Core, OpenShift Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75104.json)