A path traversal vulnerability in Home Assistant Community Store (HACS) versions before 1.10.0 permits unauthenticated attackers to access sensitive files on the host system.

This is a path traversal (CWE-22) vulnerability that allows for unauthorized file access by manipulating pathnames. The vulnerability is exploitable by unauthenticated attackers (AV:N/AC:L/PR:N/UI:N), which could lead to full account takeover or sensitive configuration disclosure.

The impact of this path traversal is severe, as it allows attackers to read arbitrary files from the server, potentially including sensitive credentials or configuration files. With a CVSS score of 7.5, this vulnerability represents a significant risk to the integrity and confidentiality of the Home Assistant deployment.

Immediate Action: Update the Home Assistant Community Store (HACS) integration to version 1.10.0 or later immediately.

Proactive Monitoring: Inspect server logs for file access attempts containing directory traversal sequences such as "../" or "/etc/passwd".

Compensating Controls: Use file system permissions to restrict the web server user's access to only the necessary directories, effectively limiting the scope of any potential traversal.

Public Exploit Available: Yes — an ExploitDB entry exists (ID 49495).

Given the potential for account takeover and sensitive data disclosure, immediate upgrading to version 1.10.0 is critical. Administrators should verify the HACS version currently running and ensure the update is applied across all affected installations to eliminate this risk.