CVE-2025-65713

Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability.

Score

CVSS 3.1 4.0 Medium

Status

Analyzed - cve@mitre.org

Published

2025-12-23

Last modified

2026-10-26

Weaknesses

CWE-22

Affected products

• Home-assistant (Home-assistant)

References

• https://github.com/home-assistant/core/pull/150046
• https://gist.github.com/GenoWang/7359360285e0fe21a7a58d10ff71d032