CVE-2026-66007 | Hugging Face Datasets up to 5.0.0 Folder-based Dataset Builders file_name path traversal

July 24, 2026 Yanac

A vulnerability described as problematic has been identified in Hugging Face Datasets up to 5.0.0. This affects an unknown function of the component Folder-based Dataset Builders. Such manipulation of the argument file_name leads to path traversal.

This vulnerability is referenced as CVE-2026-66007. It is possible to launch the attack remotely. No exploit is available.

It is advisable to implement a patch to correct this issue.VulDB Recent EntriesRead More