{"id":"CVE-2026-66007","aliases":["EUVD-2026-48613","GHSA-379c-qx7v-6h59","PYSEC-2026-3716"],"status":"published","title":"Datasets Path Traversal via Unsanitized file_name Metadata","description":"Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0055,"percentile":0.46269,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-07-24T14:58:10Z","modified":"2026-10-28T02:30:58Z","fixes":[{"ecosystem":"PyPI","package":"datasets","fixed_in":["5.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"datasets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"datasets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1"}]}],"versions":["0.0.9","1.0.0","1.0.1","1.0.2","1.1.0","1.1.1","1.1.2","1.1.3","1.10.0","1.10.1","1.10.2","1.11.0","1.12.0","1.12.1","1.13.0","1.13.1","1.13.2","1.13.3","1.14.0","1.15.0","1.15.1","1.16.0","1.16.1","1.17.0","1.18.0","1.18.1","1.18.2","1.18.3","1.18.4","1.2.0","1.2.1","1.3.0","1.4.0","1.4.1","1.5.0","1.6.0","1.6.1","1.6.2","1.7.0","1.8.0","1.9.0","2.0.0","2.1.0","2.10.0","2.10.1","2.11.0","2.12.0","2.13.0","2.13.1","2.13.2","2.14.0","2.14.1","2.14.2","2.14.3","2.14.4","2.14.5","2.14.6","2.14.7","2.15.0","2.16.0","2.16.1","2.17.0","2.17.1","2.18.0","2.19.0","2.19.1","2.19.2","2.2.0","2.2.1","2.2.2","2.20.0","2.21.0","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.8.0","2.9.0","3.0.0","3.0.1","3.0.2","3.1.0","3.2.0","3.3.0","3.3.1","3.3.2","3.4.0","3.4.1","3.5.0","3.5.1","3.6.0","4.0.0","4.1.0","4.1.1","4.2.0","4.3.0","4.4.0","4.4.1","4.4.2","4.5.0","4.6.0","4.6.1","4.7.0","4.8.0","4.8.1","4.8.2","4.8.3","4.8.4","4.8.5","5.0.0"]},{"source":"osv","ecosystem":"PyPI","package":"datasets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.1"}]}],"versions":["0.0.9","1.0.0","1.0.1","1.0.2","1.1.0","1.1.1","1.1.2","1.1.3","1.10.0","1.10.1","1.10.2","1.11.0","1.12.0","1.12.1","1.13.0","1.13.1","1.13.2","1.13.3","1.14.0","1.15.0","1.15.1","1.16.0","1.16.1","1.17.0","1.18.0","1.18.1","1.18.2","1.18.3","1.18.4","1.2.0","1.2.1","1.3.0","1.4.0","1.4.1","1.5.0","1.6.0","1.6.1","1.6.2","1.7.0","1.8.0","1.9.0","2.0.0","2.1.0","2.10.0","2.10.1","2.11.0","2.12.0","2.13.0","2.13.1","2.13.2","2.14.0","2.14.1","2.14.2","2.14.3","2.14.4","2.14.5","2.14.6","2.14.7","2.15.0","2.16.0","2.16.1","2.17.0","2.17.1","2.18.0","2.19.0","2.19.1","2.19.2","2.2.0","2.2.1","2.2.2","2.20.0","2.21.0","2.3.0","2.3.1","2.3.2","2.4.0","2.5.0","2.5.1","2.5.2","2.6.0","2.6.1","2.6.2","2.7.0","2.7.1","2.8.0","2.9.0","3.0.0","3.0.1","3.0.2","3.1.0","3.2.0","3.3.0","3.3.1","3.3.2","3.4.0","3.4.1","3.5.0","3.5.1","3.6.0","4.0.0","4.1.0","4.1.1","4.2.0","4.3.0","4.4.0","4.4.1","4.4.2","4.5.0","4.6.0","4.6.1","4.7.0","4.8.0","4.8.1","4.8.2","4.8.3","4.8.4","4.8.5","5.0.0"]}],"products":[{"vendor":"huggingface","product":"datasets"}],"references":[{"url":"https://github.com/huggingface/datasets/issues/8324","tags":["technical-description","exploit","issue-tracking","Exploit","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://github.com/huggingface/datasets/pull/8325","tags":["issue-tracking","patch","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/huggingface/datasets/commit/f989ef9b4cc6c0039a7a82458eebca49e2b58b4b","tags":["patch","Patch","fix","web"]},{"url":"https://www.vulncheck.com/advisories/datasets-path-traversal-via-unsanitized-file-name-metadata","tags":["third-party-advisory","Exploit","Patch","Third Party Advisory","advisory","web","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66007","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/datasets/PYSEC-2026-3716.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-379c-qx7v-6h59","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66007.json","tags":["advisory"]},{"url":"https://github.com/huggingface/datasets","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-66007","title":"Datasets Path Traversal via Unsanitized file_name Metadata","description":"Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.","status":"published","published":"2026-07-24T14:58:10.035Z","modified":"2026-10-01T15:20:14.881Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:12.939084Z"}],"euvd":[{"id":"EUVD-2026-48613","description":"Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.","status":"published","published":"2026-07-24T14:58:10Z","modified":"2026-10-01T15:20:14Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:45.358437Z"}],"ghsa":[{"id":"GHSA-379c-qx7v-6h59","title":"Hugging Face Datasets folder-based builders allow path traversal through file_name metadata","description":"Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.","status":"published","published":"2026-07-24T15:33:03Z","modified":"2026-10-02T22:43:38Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:41:24.739884Z"}],"nvd":[{"id":"CVE-2026-66007","description":"Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.","status":"published","published":"2026-07-24T15:19:07.493Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:32.473901Z"}],"osv":[{"id":"CVE-2026-66007","title":"Datasets Path Traversal via Unsanitized file_name Metadata","description":"Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.","status":"published","published":"2026-07-24T14:58:10.035Z","modified":"2026-10-28T02:30:58.753742812Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"GHSA-379c-qx7v-6h59","title":"Hugging Face Datasets folder-based builders allow path traversal through file_name metadata","description":"Datasets through 5.0.0, fixed in f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.","status":"published","published":"2026-07-24T15:33:03Z","modified":"2026-10-02T23:11:03.776144963Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"PYSEC-2026-3716","description":"Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.","status":"published","published":"2026-07-24T15:19:07.493Z","modified":"2026-10-15T14:45:06.499774727Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:52:57.255153Z"}]}}