CVE-2025-65713 Home Assistant Core before is vulnerable to Directory Traversal
Attackers can exploit a path traversal flaw in the Downloader integration to read or modify arbitrary files on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-65713?
CVE-2025-65713 is a medium-severity path traversal vulnerability in n/a, published on 23 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability.
Weakness: CWE-22
Which versions are affected by CVE-2025-65713?
3 open source packages ship an affected version, including homeassistant. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
homeassistant PyPI | All versions | 2025.8.0 |
homeassistant PyPI | All versions | 2025.8.0 |
homeassistant PyPI | All versions | 2025.8.0 |
Products include Home-Assistant Home-Assistant.
How do I fix CVE-2025-65713?
Upgrade homeassistant to 2025.8.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-65713 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65713 exists.
Other vulnerabilities in n/a
- CVE-2023-27482 Auth bypass in core
- CVE-2023-41895 Cross-site Scripting via auth_callback login in Home Assistant Core
- CVE-2023-41897 Lack of XFO header allows clickjacking in Home Assistant Core
- CVE-2026-54317 Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
- CVE-2020-36517 Information disclosure in n/a
Sources
Also known as GHSA-pp3g-xmm4-5cw9, PYSEC-2026-1454.