{"id":"CVE-2026-113743","kind":"vulnerability","aliases":["CVE-2026-113743"],"related":[],"title":"Tenstorrent tt-metal: path traversal in checkpoint loader lets attackers read files","description":"A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.","summary":"The function load_hf_state_dict_filtered in tt-metal's tt_transformers checkpoint loader accepts a weight_map argument that is not sanitised, so a crafted value can traverse outside the intended directory. An attacker can use this to reach files the loading process can read on the host.","severity":"high","cvss":7.5,"epss":0.00444,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ml-inference","package","python","tenstorrent","tt-metal"],"not_affected_if":["version-0.81.0-or-later"],"how_to_check":"- Check the installed tt-metal version and compare it with `0.80.0`; versions up to and including `0.80.0` are affected.\n- Look for use of `models/tt_transformers/tt/load_checkpoints.py` and the function `load_hf_state_dict_filtered` in your deployment.","fix":"- Upgrade tt-metal to `0.81.0-dev20261016` or later, which the sources state fixes this issue (patch 4851ccf347f6903c3d819eed60705600386e52c3).","status":"open","published_at":"2026-10-21T02:17:06+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:17:05+00:00","updated_at":"2026-10-25T03:17:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:17:05Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade tt-metal to `0.81.0-dev20261016` or later, which the sources state fixes this issue (patch 4851ccf347f6903c3d819eed60705600386e52c3).","reach":"internet","title":"Tenstorrent tt-metal: path traversal in checkpoint loader lets attackers read files","impact":"medium","summary":"The function load_hf_state_dict_filtered in tt-metal's tt_transformers checkpoint loader accepts a weight_map argument that is not sanitised, so a crafted value can traverse outside the intended directory. An attacker can use this to reach files the loading process can read on the host.","category":"package","nicknames":[],"who_cares":["tt-metal","tenstorrent","python","ml-inference"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads arbitrary files the loading process can access on the host","analyst_note":"Confirm from the NVD entry or the linked advisory whether weight_map can come from untrusted input and what privileges the attacker needs; the public exploit is noted but its location is not given.","how_to_check":"- Check the installed tt-metal version and compare it with `0.80.0`; versions up to and including `0.80.0` are affected.\n- Look for use of `models/tt_transformers/tt/load_checkpoints.py` and the function `load_hf_state_dict_filtered` in your deployment.","needs_analyst":true,"not_affected_if":["version-0.81.0-or-later"],"who_is_affected":"Teams that run tt-metal up to 0.80.0 and load Hugging Face style checkpoints through the tt_transformers loader, where the weight_map value can be influenced by someone outside the team. Teams on later versions or not using this loader can skip it; the sources do not say whether the weight_map value is ever attacker-controlled in default setups.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":3452,"output_tokens":673,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113743':16A,19A '-2026':15A,18A '0.80.0':92C '0.81.0':142C '4851ccf347f6903c3d819eed60705600386e52c3':152C 'accept':45B 'affect':94C,159C 'argument':49B,112C 'attack':11A,65B,119C,138C 'avail':129C 'caus':115C 'checkpoint':8A,43B 'compon':160C 'could':134C 'craft':56B 'cve':14A,17A 'dev20261016':143C 'dict':34B,102C 'directori':63B 'element':95C 'exploit':125C 'file':13A,71B,106C 'filter':35B,103C 'fix':147C 'function':30B,98C 'hf':32B,100C 'host':79B 'identifi':84C 'infer':22B 'initi':122C 'intend':62B 'issu':149C 'let':10A 'load':31B,73B,99C 'loader':9A,44B 'made':128C 'manipul':109C 'map':48B,114C 'may':120C 'metal':4A,28B,39B,89C 'ml':21B 'ml-infer':20B 'models/tt_transformers/tt/load_checkpoints.py':107C 'name':151C 'outsid':60B 'packag':23B 'patch':150C 'path':5A,116C 'process':74B 'public':132C 'python':24B 'reach':70B 'read':12A,76B 'remot':123C 'sanitis':53B 'state':33B,101C 'suffici':145C 'suggest':155C 'tenstorr':1A,25B,86C 'transform':42B 'travers':6A,59B,117C 'tt':3A,27B,38B,41B,88C 'tt-metal':2A,26B,37B,87C 'upgrad':139C,157C 'use':67B,136C 'valu':57B 'version':141C 'weak':81C 'weight':47B,113C","nicknames":[],"mitigations":[],"who_affected":"Teams that run tt-metal up to 0.80.0 and load Hugging Face style checkpoints through the tt_transformers loader, where the weight_map value can be influenced by someone outside the team. Teams on later versions or not using this loader can skip it; the sources do not say whether the weight_map value is ever attacker-controlled in default setups.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T02:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113743","severity":null,"published_at":"2026-10-21T02:17:06+00:00","modified_at":"2026-10-21T14:26:26+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113743","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113743","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}