Software
Breachwright← Back to the database
medium · 6.5Maintainer reviewedAASD-2026-0005
Hugging Face Datasets folder builders permit local file disclosure through metadata path traversal
Hugging Face Datasets through 5.0.0 did not adequately constrain the attacker-controlled file_name field used by its imagefolder, audiofolder, videofolder, and pdffolder builders. Loading a crafted local or Hub dataset could read files outside the dataset directory; a later save_to_disk or push_to_hub operation could embed those bytes in exported dataset content.
Prerequisites
- A victim loads a dataset whose folder-builder metadata is controlled by an attacker
- The vulnerable process can read sensitive files outside the dataset directory
Potential impact
- Disclosure of files readable by the process running Hugging Face Datasets
- Embedding of disclosed bytes into output created by save_to_disk or push_to_hub
Mitigations
- Use a Datasets build that contains commit f989ef9b4cc6c0039a7a82458eebca49e2b58b4b, or upgrade to the first tagged release that includes it
- Do not load untrusted local or Hub datasets with folder-based builders on systems that hold sensitive files
- Run dataset processing in a least-privileged, isolated environment without unrelated credentials or host data
- Review folder-builder metadata for absolute paths, URL schemes, and parent-directory traversal before processing
Public sources
Research note
The maintainer merged the fix to main on 2026-07-23, but no tagged release containing it was identified when this record was verified. This record does not claim automatic exfiltration: disclosure into a remote destination requires a victim to export or publish the affected dataset. Not listed in the CISA Known Exploited Vulnerabilities catalog when verified on 2026-07-28.