PT-2021-19401 · Unknown · Home Assistant

Oriel Goel · Published 2021-01-21 · Updated 2026-04-23 · CVE-2021-3152

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2021.1.3

Description The issue is related to a lack of protection against directory-traversal attacks in custom integrations. It is noted that the vendor views the vulnerability as being in custom integrations written by third parties, rather than in Home Assistant itself. However, Home Assistant has a security update that addresses this situation.

Recommendations For versions prior to 2021.1.3, update to version 2021.1.3 or later to address the issue. As a temporary workaround, consider restricting access to custom integrations until the update is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-3152

Affected Products

Home Assistant

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-3152 · Security Note
• https://home-assistant.io/blog/2021/01/14/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3152 · Vendor Advisory
• https://home-assistant.io/blog/2021/01/22/security-disclosure · Vendor Advisory
• https://twitter.com/pdnuclei_bot/status/2047239086466089122 · Twitter Post
• https://t.me/cvenotify/88812 · Telegram Post