-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| homeassistant | pip | < 2025.8.0 | 2025.8.0 |
Miggo AIRoot Cause AnalysisThe analysis of the provided pull request and its associated commits clearly indicates a path traversal vulnerability within the downloader component of Home Assistant Core. The vulnerability existed in the download_file service, which is handled by the download_file function in homeassistant/components/downloader/services.py. The commits from the pull request show that the fix involved adding stricter validation to the user-provided subdir parameter. Specifically, commit 41342be86844a590762a08bb3df55aa445258c0f introduced checks to ensure the subdir is not an absolute path and uses raise_if_invalid_path to prevent directory traversal attacks. The lack of these checks in the previous version of the code is the root cause of the vulnerability. The download_file function is the direct entry point for the malicious input and is where the path concatenation would occur, making it the primary vulnerable function.
homeassistant.components.downloader.services.download_filehomeassistant/components/downloader/services.py