# CVE-2021-3152: Home Assistant - Path Traversal

> Live exploitation tracking for CVE-2021-3152 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-3152

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** Home Assistant
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** iot, web_application

## Description

Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks against custom integrations. NOTE: the vendor's perspective is that the vulnerability itself is in custom integrations written by third parties, not in Home Assistant; however, Home Assistant does have a security update that is worthwhile in addressing this situation

## CrowdSec analysis

[CVE-2021-3152](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-3152) is a directory traversal vulnerability affecting Home Assistant versions prior to 2021.1.3, where the platform lacked safeguards to prevent path traversal attacks in custom third-party integrations. This flaw could allow remote attackers to access sensitive files outside the intended directories, potentially exposing confidential information.

CrowdSec has been tracking this vulnerability and its exploits since 6th of May 2026.

CrowdSec network observations suggest that most exploitation of CVE-2021-3152 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental.
In addition, according to the CrowdSec network, attack volume against CVE-2021-3152 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending requests to URLs containing `/hacsfiles/../` to perform directory traversal and access sensitive files such as `configuration.yaml` on Home Assistant instances.

## Timeline

- 2021-01-21: CVE Published. CVE-2021-3152 is published to NVD.
- 2026-05-06: Rule Released. CrowdSec releases a rule to detect CVE-2021-3152 exploitation attempts against the CrowdSec Network.
- 2026-05-18: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-3152 for the first time.

## References

- https://www.home-assistant.io/blog/2021/01/22/security-disclosure/
- https://www.home-assistant.io/blog/2021/01/14/security-bulletin/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-3152.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-3152) follows observed exploitation activity for CVE-2021-3152. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.