{"id":"CVE-2026-126995","kind":"vulnerability","aliases":["CVE-2026-126995"],"related":[],"title":"Jlama: a crafted model package can make weight loading read files outside its directory (path traversal)","description":"A vulnerability was found in tjake Jlama up to 0.8.4/0.9.0-beta. Affected by this vulnerability is the function SafeTensorIndex.loadWeights of the file jlama-core/src/main/java/com/github/tjake/jlama/safetensors/SafeTensorIndex.java. Performing a manipulation of the argument weight_map results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"Jlama's SafeTensorIndex.loadWeights uses the values in a model's model.safetensors.index.json weight_map as file paths without normalizing them or checking they stay inside the model directory. A model package with an index entry such as ../../victim/external.safetensors makes Jlama memory-map that file and load its tensors. The reporter's public PoC shows weights being substituted. Only files that parse as safetensors shards can be read, and exposure needs the attacker to supply the model package.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"jlama-core","fixed":[],"affected":">= 0.8.0, <= 0.8.4; 0.9.0-beta (main at 7b8ba424)","ecosystem":"maven"}],"ecosystems":[],"tags":["ai-tooling","java","jlama","llm","path-traversal","self-hosted","untrusted-models"],"not_affected_if":["fixed-local-models","no-jlama","trusted-local-models-only"],"how_to_check":"- Find Jlama in your build: run mvn dependency:tree or gradle dependencies and look for com.github.tjake:jlama-core (reported affected: 0.8.0 to 0.8.4, and main at 0.9.0-beta).\n- Check whether your app loads model directories it did not build itself (downloaded from a hub, user uploads, shared storage), via SafeTensorSupport.loadWeights or a Jlama model loader. If so, inspect each model.safetensors.index.json: any weight_map value containing .. or an absolute path is a sign of abuse.\n- Apps that only load models you have vetted and stored locally are much less exposed.","fix":"No fixed version: issue #211 is open and the maintainer has not responded. Until then, load only trusted model packages, reject weight_map values that are absolute or contain .. before loading, and run Jlama with a filesystem account that can read only the model directory. The reporter suggests resolving each value against the model root, normalizing, and rejecting any path that escapes the root.","status":"open","published_at":"2026-11-12T14:17:28+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","triaged_at":"2026-11-12T14:39:05+00:00","updated_at":"2026-11-12T14:40:00+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-12T14:39:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Jlama: path traversal in model weight loading lets attackers read files","impact":"medium","summary":"Jlama, a Java library for running large language models, fails to validate paths in the weight_map argument when loading SafeTensors model weights. A remote attacker can manipulate that input to traverse outside the intended directory.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["java","jlama","llm","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads arbitrary files on the server","analyst_note":"Confirm the affected version range and whether a fix or patch exists at the Jlama repository or NVD; the exploit is public and the vendor has not responded.","how_to_check":"- Check whether the `jlama-core` artifact is on your classpath and its version, for example with `mvn dependency:tree` or `gradle dependencies`\n- Look for any code path that passes untrusted input into `SafeTensorIndex.loadWeights`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-local-models","no-jlama"],"who_is_affected":"Teams that embed Jlama in a Java service and let outside input influence which model weight files get loaded are exposed. Applications that load only fixed, locally stored models are less exposed. The sources do not list a fixed version, and the project has not responded to the report.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000731,"input_tokens":4625,"output_tokens":538,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected version range and whether a fix or patch exists at the Jlama repository or NVD; the exploit is public and the vendor has not responded.","search":"'-126995':19A,22A '-2026':18A,21A '/../victim/external.safetensors':77B '/0.9.0-beta':128C '/src/main/java/com/github/tjake/jlama/safetensors/safetensorindex.java':143C '0.8.4':127C 'affect':129C 'ai':27B 'ai-tool':26B 'argument':149C 'attack':112B,157C 'check':61B 'core':25A,142C 'could':169C 'craft':3A 'cve':17A,20A 'directori':14A,67B 'earli':179C 'entri':74B 'exploit':163C 'exposur':109B 'file':11A,55B,84B,99B,139C 'found':121C 'function':135C 'host':37B 'index':73B 'inform':175C 'initi':160C 'insid':64B 'issu':182C 'java':29B 'jlama':1A,24A,30B,41B,79B,124C,141C 'jlama-cor':140C 'jlama-core':23A 'llm':31B 'load':9A,86B 'made':166C 'make':7A,78B 'manipul':146C 'map':53B,82B,151C 'may':158C 'memori':81B 'memory-map':80B 'model':4A,40B,49B,66B,69B,116B 'model.safetensors.index.json':51B 'need':110B 'normal':58B 'outsid':12A 'packag':5A,70B,117B 'pars':101B 'path':15A,33B,56B,154C 'path-travers':32B 'perform':144C 'poc':93B 'problem':178C 'project':173C 'public':92B,167C 'read':10A,107B 'remot':161C 'report':90B,183C 'respond':187C 'result':152C 'safetensor':103B 'safetensorindex.loadweights':43B,136C 'self':36B 'self-host':35B 'shard':104B 'show':94B 'stay':63B 'substitut':97B 'suppli':114B 'tensor':88B 'tjake':123C 'tool':28B 'travers':16A,34B,155C 'untrust':39B 'untrusted-model':38B 'use':44B,171C 'valu':46B 'vulner':119C,132C 'weight':8A,52B,95B,150C 'without':57B 'yet':188C","nicknames":[],"mitigations":[],"who_affected":"Java services that embed Jlama (jlama-core, versions up to 0.8.4 and the 0.9.0-beta main branch) and load model directories from outside sources, such as downloaded models or user-supplied packages, are exposed. The attacker supplies a model package whose index points at other files; the process can then map any safetensors-format file it can read into the model, or silently swap in different weights. Teams that load only models they built and trust can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["jlamacore"],"ptokens":["core","jlama"],"labels":["aitooling","high","java","jlama","llm","pathtraversal","selfhosted","untrustedmodels"],"campaign_type":null,"search_a":"'-126995':19A,22A '-2026':18A,21A 'core':25A 'craft':3A 'cve':17A,20A 'directori':14A 'file':11A 'jlama':1A,24A 'jlama-core':23A 'load':9A 'make':7A 'model':4A 'outsid':12A 'packag':5A 'path':15A 'read':10A 'travers':16A 'weight':8A","search_b":"'/../victim/external.safetensors':77B 'ai':27B 'ai-tool':26B 'attack':112B 'check':61B 'directori':67B 'entri':74B 'exposur':109B 'file':55B,84B,99B 'host':37B 'index':73B 'insid':64B 'java':29B 'jlama':30B,41B,79B 'llm':31B 'load':86B 'make':78B 'map':53B,82B 'memori':81B 'memory-map':80B 'model':40B,49B,66B,69B,116B 'model.safetensors.index.json':51B 'need':110B 'normal':58B 'packag':70B,117B 'pars':101B 'path':33B,56B 'path-travers':32B 'poc':93B 'public':92B 'read':107B 'report':90B 'safetensor':103B 'safetensorindex.loadweights':43B 'self':36B 'self-host':35B 'shard':104B 'show':94B 'stay':63B 'substitut':97B 'suppli':114B 'tensor':88B 'tool':28B 'travers':34B 'untrust':39B 'untrusted-model':38B 'use':44B 'valu':46B 'weight':52B,95B 'without':57B","search_c":"'/0.9.0-beta':128C '/src/main/java/com/github/tjake/jlama/safetensors/safetensorindex.java':143C '0.8.4':127C 'affect':129C 'argument':149C 'attack':157C 'core':142C 'could':169C 'earli':179C 'exploit':163C 'file':139C 'found':121C 'function':135C 'inform':175C 'initi':160C 'issu':182C 'jlama':124C,141C 'jlama-cor':140C 'made':166C 'manipul':146C 'map':151C 'may':158C 'path':154C 'perform':144C 'problem':178C 'project':173C 'public':167C 'remot':161C 'report':183C 'respond':187C 'result':152C 'safetensorindex.loadweights':136C 'tjake':123C 'travers':155C 'use':171C 'vulner':119C,132C 'weight':150C 'yet':188C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T14:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126995","severity":null,"published_at":"2026-11-12T14:17:28+00:00","modified_at":"2026-11-12T14:17:29+00:00","first_seen_at":"2026-11-12T14:38:37+00:00","fetched_at":"2026-11-12T14:38:37+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126995:3738","url":"https://github.com/tjake/Jlama/issues/211","severity":null,"published_at":"2026-11-12T14:40:00+00:00","modified_at":"2026-11-12T14:40:00+00:00","first_seen_at":"2026-11-12T14:40:00+00:00","fetched_at":"2026-11-12T14:40:00+00:00","note":"Read GitHub issue #211 (reporter's PoC, open, no maintainer reply) and NVD. Triage's 'remote attacker read files' overstated: trigger is a malicious model package; read limited to safetensors-format files. No fix; nothing marked verified (reporter, not vendor, source). No x search done.","cites":["https://github.com/tjake/Jlama/issues/211","https://nvd.nist.gov/vuln/detail/CVE-2026-126995"]}],"documents":[{"id":135685,"url":"https://github.com/tjake/Jlama/issues/211","title":"Jlama #211: Path traversal in model.safetensors.index.json weight_map","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":135686,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126995","title":"NVD CVE-2026-126995","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}