---
id: "CVE-2026-113738"
kind: "vulnerability"
aliases: ["CVE-2026-113738"]
title: "Jackrong llm-finetuning-guide: path traversal in MTP weight loader script"
severity: "high"
cvss: 7.5
epss: 0.00406
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["gguf", "llm-finetuning", "other", "python", "qwen"]
not_affected_if: ["no-remote-input"]
published_at: "2026-10-21T01:17:25+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T03:17:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113738", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-113738", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Jackrong llm-finetuning-guide: path traversal in MTP weight loader script

A path traversal flaw in the extract_mtp_heads function of a Qwen MTP GGUF pipeline script lets a crafted shard_name argument reach files outside the intended directory. The sources say the attack can be started remotely and that the exploit is public, but no authentication or version details are given.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the repository is in use: look for `qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py` in the checkout.
- Compare the checkout to commit `ef2b17f2798cd18cd85375080c35a58397ad0d09` (`git log -1`); the sources say all commits up to it are affected.
- Confirm whether the script is run on a machine that accepts shard names from outside, which the sources do not describe.

## Fix

- No fixed version is listed: the project is a rolling release and has not responded to the report.
- Do not run the affected script on untrusted shard_name input until a patched commit is published.
- Validate or restrict shard_name paths to the expected directory in a local patch.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113738
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-113738

## From the sources

A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py of the component MTP weight_map Handler. The manipulation of the argument shard_name leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_