Path Traversal Vulnerability in Hugging Face Accelerate Product
CVE-2026-69112

6.9MEDIUM

Key Information:

Vendor: Huggingface
Status: Accelerate
Vendor: CVE Published:; 10 August 2026

🔔 Create Huggingface Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-69112?

Hugging Face Accelerate versions up to 1.14.0 are susceptible to a path traversal vulnerability found in the load_checkpoint_in_model and load_checkpoint_and_dispatch functions. This issue arises from improper sanitization of weight_map entries that are sourced from sharded checkpoint indexes. An attacker can exploit this flaw by supplying relative paths with '../' sequences or providing absolute paths to access arbitrary files on the system. Additionally, manipulating shard entries to direct towards named pipes may lead to indefinite blocking, ultimately resulting in a denial of service. It’s crucial for users to apply relevant security updates to mitigate these risks.

Affected Version(s)

accelerate 0 <= 1.14.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-69112 - Proof of Concept