Threat database

CVE-2026-113738 is a path traversal vulnerability in the extract_mtp_heads function of the qwen_mtp_gguf_pipeline.py script within the MTP weight_map Handler component of R6410418 Jackrong-llm-finetuning-guide. The vulnerability allows remote attackers to manipulate the shard_name argument to perform path traversal. The product uses a rolling release model, so no specific affected or fixed versions are provided. The issue was reported early but the project has not responded yet. The CVSS 4.0 score is 5.3, indicating medium severity.

CVE-2026-113737 is a path traversal vulnerability in the R6410418 Jackrong-llm-finetuning-guide project affecting the validate_indexed_tensors function in the qwen_mtp_gguf_pipeline.py script. Manipulation of the weight_map argument can lead to path traversal, potentially exploitable remotely. The project uses a rolling release system, so specific affected versions are not disclosed. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1. The issue was reported early but the project has not yet responded or released a fix. Exploit code has been published but no known exploitation in the wild is reported.