{"id":"CVE-2026-113738","kind":"vulnerability","aliases":["CVE-2026-113738"],"related":[],"title":"Jackrong llm-finetuning-guide: path traversal in MTP weight loader script","description":"A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py of the component MTP weight_map Handler. The manipulation of the argument shard_name leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.","summary":"A path traversal flaw in the extract_mtp_heads function of a Qwen MTP GGUF pipeline script lets a crafted shard_name argument reach files outside the intended directory. The sources say the attack can be started remotely and that the exploit is public, but no authentication or version details are given.","severity":"high","cvss":7.5,"epss":0.00406,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gguf","llm-finetuning","other","python","qwen"],"not_affected_if":["no-remote-input"],"how_to_check":"- Check whether the repository is in use: look for `qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py` in the checkout.\n- Compare the checkout to commit `ef2b17f2798cd18cd85375080c35a58397ad0d09` (`git log -1`); the sources say all commits up to it are affected.\n- Confirm whether the script is run on a machine that accepts shard names from outside, which the sources do not describe.","fix":"- No fixed version is listed: the project is a rolling release and has not responded to the report.\n- Do not run the affected script on untrusted shard_name input until a patched commit is published.\n- Validate or restrict shard_name paths to the expected directory in a local patch.","status":"open","published_at":"2026-10-21T01:17:25+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:17:07+00:00","updated_at":"2026-10-25T03:17:07+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T03:17:07Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version is listed: the project is a rolling release and has not responded to the report.\n- Do not run the affected script on untrusted shard_name input until a patched commit is published.\n- Validate or restrict shard_name paths to the expected directory in a local patch.","reach":"unknown","title":"Jackrong llm-finetuning-guide: path traversal in MTP weight loader script","impact":"medium","summary":"A path traversal flaw in the extract_mtp_heads function of a Qwen MTP GGUF pipeline script lets a crafted shard_name argument reach files outside the intended directory. The sources say the attack can be started remotely and that the exploit is public, but no authentication or version details are given.","category":"other","nicknames":[],"who_cares":["python","llm-finetuning","qwen","gguf"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or writes files outside the intended directory on the host.","analyst_note":"Confirm how shard_name reaches extract_mtp_heads (remote input path or local CLI only) and whether the file read or write is attacker-controlled; check the NVD entry and the repository issue for details.","how_to_check":"- Check whether the repository is in use: look for `qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py` in the checkout.\n- Compare the checkout to commit `ef2b17f2798cd18cd85375080c35a58397ad0d09` (`git log -1`); the sources say all commits up to it are affected.\n- Confirm whether the script is run on a machine that accepts shard names from outside, which the sources do not describe.","needs_analyst":true,"not_affected_if":["no-remote-input"],"who_is_affected":"unknown. The sources say the project is a rolling release with all commits up to ef2b17f2798cd18cd85375080c35a58397ad0d09 affected, and that the attack can be started remotely. They do not say how a remote shard_name reaches the script, so teams that only run the guide's scripts locally on their own model files are likely lower risk.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":3523,"output_tokens":748,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113738':15A,18A '-2026':14A,17A '/scripts/qwen_mtp_gguf_pipeline.py':108C 'affect':95C,163C 'argument':48B,120C 'attack':59B,133C 'authent':72B 'avail':168C 'compon':111C 'contini':156C 'craft':45B 'cve':13A,16A 'deliveri':157C 'detail':75B,161C 'directori':54B 'disclos':139C 'earli':176C 'ef2b17f2798cd18cd85375080c35a58397ad0d09':92C 'exploit':67B,136C 'extract':32B,98C 'file':50B,103C 'finetun':4A,22B,88C 'flaw':29B 'found':82C 'function':35B,97C 'gguf':19B,40B,107C 'given':77B 'guid':5A,89C 'handler':115C 'head':34B,100C 'inform':172C 'initi':131C 'intend':53B 'issu':179C 'jackrong':1A,86C 'jackrong-llm-finetuning-guid':85C 'lead':123C 'let':43B 'llm':3A,21B,87C 'llm-finetun':20B 'llm-finetuning-guid':2A 'loader':11A 'manipul':117C 'map':114C 'may':144C 'mtp':9A,33B,39B,99C,106C,112C 'name':47B,122C 'outsid':51B 'path':6A,27B,125C 'pipelin':41B 'possibl':129C 'problem':175C 'product':148C 'project':170C 'provid':155C 'public':69B,142C 'python':24B 'qwen':25B,38B,105C 'qwen-mtp-gguf':104C 'r6410418':84C 'reach':49B 'releas':153C,166C 'remot':63B,134C 'report':180C 'respond':184C 'roll':152C 'say':57B 'script':12A,42B 'shard':46B,121C 'sourc':56B 'start':62B 'therefor':158C 'travers':7A,28B,126C 'updat':165C 'use':146C,150C 'version':74B,160C 'vulner':79C,94C 'weight':10A,113C 'yet':185C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113738","severity":null,"published_at":"2026-10-21T01:17:25+00:00","modified_at":"2026-10-21T14:26:26+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113738","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113738","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}