Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability.
{
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-23T19:47:00Z",
"nvd_published_at": "2025-12-23T17:15:48Z",
"severity": "MODERATE"
}