CVE-2026-66007

MediumCVSS 6.5

Published: 24/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.55%

45th percentile - higher than 45% of all known CVEs

Summary

Path traversal vulnerability in the Datasets library up to version 5.0.0. The file_name metadata field is not properly validated before being joined to the dataset directory, allowing attackers to read arbitrary local files using '../' sequences.

Risk Assessment

An attacker can read sensitive system files, which are then embedded into output when saving or publishing the dataset.

Recommendation

Update the Datasets library to the fixed version (commit f989ef9) or implement path validation for the file_name field.

Other vulnerabilities in Datasets

CVE-2026-65010Medium
Datasets up to version 5.00 (fixed in commit ad2d853) has a symlink-following vulnerability in Extractor.extract(). A local attacker can pre-plant symlinks at predictable output paths to write arbitrary files outside the target directory.

Original NVD description (English source)

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the file_name metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted file_name values with directory traversal sequences to read arbitrary local files, which are then embedded into output when save_to_disk or push_to_hub is called.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS