VYPR
← All advisories
High severity7.5NVD Advisory· Published May 16, 2026

CVE-2021-47942

CVE-2021-47942

Description

Home Assistant Community Store (HACS) 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh tokens, then craft valid JWT tokens to gain administrative access to Home Assistant instances.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Path traversal in HACS 1.10.0 allows unauthenticated attackers to read sensitive files and craft JWT tokens for admin access to Home Assistant.

Vulnerability

Overview

Home Assistant Community Store (HACS) versions prior to 1.10.0 contain a path traversal vulnerability in the /hacsfiles/ endpoint. The endpoint fails to properly sanitize user-supplied paths, allowing an attacker to traverse directories using ../ sequences. This enables retrieval of arbitrary files from the Home Assistant filesystem, including the .storage/auth file which stores user credentials and refresh tokens [2][3].

Exploitation

An unauthenticated attacker can send a crafted GET request to http://<target>:<port>/hacsfiles/../../.storage/auth to download the authentication database. The response contains JSON data with user IDs, refresh tokens, and JWT signing keys. Using these tokens, the attacker can forge valid JWT tokens by encoding the issuer claim with the stolen jwt_key and algorithm HS256 [2]. The exploit requires no authentication and can be executed remotely over the network.

Impact

Successful exploitation grants the attacker administrative access to the Home Assistant instance. With a forged JWT token, the attacker can impersonate the owner user, gaining full control over all connected smart home devices, automations, and integrations. This effectively compromises the entire home automation system [3].

Mitigation

The vulnerability is fixed in HACS version 1.10.0. Users should upgrade to this version or later immediately. No workarounds are available for earlier versions [4]. The issue has been publicly documented with proof-of-concept exploit code, increasing the risk of active exploitation [2].

References
  1. OffSec’s Exploit Database Archive
  2. Home Assistant Community Store 1.10.0 Path Traversal Account Takeover
  3. GitHub - hacs/integration: HACS gives you a powerful UI to handle downloads of all your custom needs.

AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

3

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

3

News mentions

50