---
id: "CVE-2026-126995"
page: "https://infrastack.ai/live/CVE-2026-126995"
kind: "vulnerability"
aliases: ["CVE-2026-126995"]
title: "Jlama: a crafted model package can make weight loading read files outside its directory (path traversal)"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "jlama-core", "fixed": [], "affected": ">= 0.8.0, <= 0.8.4; 0.9.0-beta (main at 7b8ba424)", "ecosystem": "maven"}]
ecosystems: []
tags: ["ai-tooling", "java", "jlama", "llm", "path-traversal", "self-hosted", "untrusted-models"]
not_affected_if: ["fixed-local-models", "no-jlama", "trusted-local-models-only"]
published_at: "2026-11-12T14:17:28+00:00"
first_seen_at: "2026-11-12T14:38:37+00:00"
updated_at: "2026-11-12T14:40:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126995", "first_seen_at": "2026-11-12T14:38:37+00:00"}, {"source": "analyst", "url": "https://github.com/tjake/Jlama/issues/211", "first_seen_at": "2026-11-12T14:40:00+00:00", "cites": ["https://github.com/tjake/Jlama/issues/211", "https://nvd.nist.gov/vuln/detail/CVE-2026-126995"]}]
exploit_sources: []
---

# Jlama: a crafted model package can make weight loading read files outside its directory (path traversal)

Link for people: https://infrastack.ai/live/CVE-2026-126995 (this .md is for agents)

Jlama's SafeTensorIndex.loadWeights uses the values in a model's model.safetensors.index.json weight_map as file paths without normalizing them or checking they stay inside the model directory. A model package with an index entry such as ../../victim/external.safetensors makes Jlama memory-map that file and load its tensors. The reporter's public PoC shows weights being substituted. Only files that parse as safetensors shards can be read, and exposure needs the attacker to supply the model package.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:jlama-core affected >= 0.8.0, <= 0.8.4; 0.9.0-beta (main at 7b8ba424) fixed no fixed version listed

## How to check

- Find Jlama in your build: run mvn dependency:tree or gradle dependencies and look for com.github.tjake:jlama-core (reported affected: 0.8.0 to 0.8.4, and main at 0.9.0-beta).
- Check whether your app loads model directories it did not build itself (downloaded from a hub, user uploads, shared storage), via SafeTensorSupport.loadWeights or a Jlama model loader. If so, inspect each model.safetensors.index.json: any weight_map value containing .. or an absolute path is a sign of abuse.
- Apps that only load models you have vetted and stored locally are much less exposed.

## Fix

No fixed version: issue #211 is open and the maintainer has not responded. Until then, load only trusted model packages, reject weight_map values that are absolute or contain .. before loading, and run Jlama with a filesystem account that can read only the model directory. The reporter suggests resolving each value against the model root, normalizing, and rejecting any path that escapes the root.

## Timeline

- 2026-11-12T14:38:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126995
- 2026-11-12T14:40:00+00:00 analyst https://github.com/tjake/Jlama/issues/211 — Read GitHub issue #211 (reporter's PoC, open, no maintainer reply) and NVD. Triage's 'remote attacker read files' overstated: trigger is a malicious model package; read limited to safetensors-format files. No fix; nothing marked verified (reporter, not vendor, source). No x search done.

## Documents

- [advisory] Jlama #211: Path traversal in model.safetensors.index.json weight_map https://github.com/tjake/Jlama/issues/211
- [describes] NVD CVE-2026-126995 https://nvd.nist.gov/vuln/detail/CVE-2026-126995

## From the sources

A vulnerability was found in tjake Jlama up to 0.8.4/0.9.0-beta. Affected by this vulnerability is the function SafeTensorIndex.loadWeights of the file jlama-core/src/main/java/com/github/tjake/jlama/safetensors/SafeTensorIndex.java. Performing a manipulation of the argument weight_map results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_