CVE-2025-65713: 
Python vulnerability analysis and mitigation

CVE-2025-65713 is a directory traversal vulnerability in the Home Assistant Core Downloader integration, classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). It affects all versions of Home Assistant Core before v2025.8.0, where insufficient path validation during file path concatenation allows an attacker to traverse outside the intended download directory. The CVE was published on December 23, 2025, with the patch merged on August 5, 2025 and included in the v2025.8.0 milestone. It carries a CVSS v3.1 base score of 4.0 (Medium) (GitHub Advisory, NVD).

The root cause lies in the download_file function within homeassistant/components/downloader/services.py. When a subdir parameter is provided, the code calls raise_if_invalid_path(subdir) but then directly concatenates the subdirectory with the base download path using os.path.join() without verifying that the resulting path remains within the intended download directory. The raise_if_invalid_path utility (defined in homeassistant/util/__init__.py) does not fully prevent path traversal sequences such as ../ from escaping the configured download root when combined via os.path.join(). A local attacker with access to the Home Assistant service call interface can supply a crafted subdir value to read or write files outside the designated download directory (NVD, HA PR #150046, services.py source).

Successful exploitation allows a local attacker to read arbitrary files on the Home Assistant host system by directing downloads to paths outside the configured download directory, potentially exposing sensitive configuration files, credentials, secrets, or other private data stored on the system. The vulnerability has no integrity or availability impact per the CVSS assessment, but the confidentiality exposure could enable further compromise if credentials or API tokens are accessed. The scope is limited to the local system running Home Assistant Core (GitHub Advisory, NVD).

A public proof-of-concept is referenced in the NVD entry (attributed to researcher GenoWang via a GitHub Gist), though the Gist content was not publicly accessible at time of analysis (NVD). The EPSS score is approximately 0.019%, indicating a low probability of widespread exploitation in the near term. There is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the Home Assistant service call interface, limiting the attack surface (GitHub Advisory).

1. Identify target: Confirm the target is running Home Assistant Core before v2025.8.0 with the Downloader integration enabled and configured with a download directory.
2. Gain local access: Obtain access to the Home Assistant instance — this could be via a legitimate user account, a compromised automation, or local network access to the HA API.
3. Craft malicious service call: Invoke the downloader.download_file service with a URL pointing to a known or attacker-controlled resource, and set the subdir parameter to a path traversal sequence such as ../../config or ../../../etc.
4. Trigger path concatenation: The vulnerable code concatenates the base download path with the unsanitized subdir value using os.path.join(), resolving to a directory outside the intended download root.
5. Access sensitive files: The downloaded file is written to (or read from) the traversed path, potentially exposing Home Assistant configuration files (e.g., secrets.yaml, configuration.yaml) or system files containing credentials (NVD, services.py source).

• Logs: Home Assistant logs showing downloader.download_file service calls with subdir values containing ../ sequences or absolute paths outside the configured download directory; entries in home-assistant.log referencing unexpected file paths.
• File System: Unexpected files appearing in directories outside the configured Home Assistant download folder (e.g., in /config, /etc, or home directories); modification timestamps on sensitive files (e.g., secrets.yaml, configuration.yaml) coinciding with Downloader service activity.
• Network: Outbound HTTP requests from the Home Assistant process to unfamiliar or attacker-controlled URLs triggered via the Downloader service, particularly if correlated with unusual subdir parameters in service call logs.

Upgrade Home Assistant Core to version 2025.8.0 or later, which includes the fix merged via PR #150046 that adds proper subdirectory path validation and raises a ServiceValidationError for invalid paths (HA PR #150046). As a temporary workaround prior to upgrading, restrict access to the Home Assistant instance to trusted users only and avoid exposing the Downloader integration to untrusted automation or external inputs. Additionally, review and audit any existing automations or scripts that invoke the downloader.download_file service with user-controlled subdir parameters (GitHub Advisory).

Coverage of CVE-2025-65713 has been limited to vulnerability tracking platforms and security advisory aggregators, with no notable vendor statements beyond the patch PR and GitHub Security Advisory. A brief technical write-up was published by Infinitsec shortly after disclosure (Infinitsec). The vulnerability's medium severity and local-only attack vector have kept broader community and media attention minimal.