GitHub Advisoryadvisory · PyPI

GHSA-pp3g-xmm4-5cw9 Home Assistant Core before is vulnerable to Directory Traversal

MEDIUM Published 2025-12-23 Modified 2025-12-23 Official page ↗
Aliases
CVE-2025-65713
Ecosystem
PyPI
Packages
homeassistant
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Weaknesses
CWE-22
Reviewed
2025-12-23

Affected packages

• PyPI homeassistant: < 2025.8.0 → fixed in 2025.8.0

Description

Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability.

Related

Alias · CVE (1)

  • CVE-2025-65713 Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References