CVE-2026-66007

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.

• CWE-22

• https://github.com/huggingface/datasets/commit/f989ef9b4cc6c0039a7a82458eebca49e2b58b4bPatch
• https://github.com/huggingface/datasets/issues/8324Exploit, Issue Tracking, Vendor Advisory
• https://github.com/huggingface/datasets/pull/8325Issue Tracking, Patch
• https://www.vulncheck.com/advisories/datasets-path-traversal-via-unsanitized-file-name-metadataExploit, Patch, Third Party Advisory

Published

Jul 24, 2026

Last Modified

Aug 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66001Frappe is a full-stack web application framework. Prior to 1…8.5
• CVE-2026-66002Frappe is a full-stack web application framework. Prior to 1…6.9
• CVE-2026-66003Frappe is a full-stack web application framework written in …7.1
• CVE-2026-66004BlenderMCP before commit 30a3308 contains a path traversal v…6
• CVE-2026-66005Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS …6.3
• CVE-2026-66006lakeFS through 1.83.0, fixed in commit 71a45ee, contains an …6.9
• CVE-2026-66008Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= …6.3
• CVE-2026-66009Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= …6.3
• CVE-2026-6601A vulnerability has been found in Lagom WHMCS Template up to…4.3
• CVE-2026-66010DOMPurify before 3.4.12 fails to execute afterSanitizeElemen…6.1
• CVE-2026-66011ImageMagick before 7.1.2-27 contains a memory leak vulnerabi…3.3
• CVE-2026-66012SiYuan before v3.7.2 contains a missing authorization vulner…10