CVE-2025-65713: Home Assistant Core Directory Traversal Vulnerability
Summary
CVE-2025-65713: Home Assistant Core before is vulnerable to Directory Traversal. Affects homeassistant versions < 2025.8.0. Fixed in 2025.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Home Assistant Core is an open-source home automation platform that focuses on privacy and local control. It allows users to control smart home devices and automate tasks through a user-friendly interface. The platform integrates with various devices and services, providing a centralized hub for home automation. However, prior to version 2025.8.0, Home Assistant Core is vulnerable to a Directory Traversal issue in its Downloader integration, which can lead to unauthorized access to the file system.
Vulnerability Detail
The vulnerability arises from inadequate validation of file paths during the concatenation process in the Downloader integration of Home Assistant Core. This flaw allows attackers to exploit the system by crafting malicious file paths, potentially leading to unauthorized file access and manipulation. The ramifications of this vulnerability can be severe, as it may allow attackers to read sensitive files on the server, leading to data breaches or further exploitation of the system.
How To Fix
Latest published version: 2026.10.2 as of 22 Oct 2026
pip install --upgrade "homeassistant==2026.10.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2025.8.0
This is the first release that contains the fix.
pip install --upgrade "homeassistant==2025.8.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Home Assistant installation directory and ensure that only trusted users have the ability to modify configurations or access the file system. However, the best course of action is to apply the patch by updating to the latest version.
Conclusion
The Directory Traversal vulnerability in Home Assistant Core prior to version 2025.8.0 poses significant risks to users by allowing unauthorized file access. It is crucial for users to update their installations to the patched version to mitigate these risks effectively.
See every vulnerability recorded for homeassistant →
FAQ
A Directory Traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory. This can lead to unauthorized access to sensitive data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update, consider implementing strict access controls and monitoring your system for any suspicious activity as a temporary measure.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files, data breaches, and potential further exploitation of the system.
The CVSS score for this vulnerability is 7.0, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for homeassistant.
