Home Assistant - Path Traversal (CVE-2021-3152)

CVE-2021-3152 is a directory traversal vulnerability affecting Home Assistant versions prior to 2021.1.3, where the platform lacked safeguards to prevent path traversal attacks in custom third-party integrations. This flaw could allow remote attackers to access sensitive files outside the intended directories, potentially exposing confidential information.

CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.

CrowdSec network observations suggest that most exploitation of CVE-2021-3152 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2021-3152 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending requests to URLs containing /hacsfiles/../ to perform directory traversal and access sensitive files such as configuration.yaml on Home Assistant instances.