Submeter #1016281: R6410418 Jackrong-llm-finetuning-guide commit ef2b17f2798c Path Traversal

A vulnerability was found in Jackrong-llm-finetuning-guide commit ef2b17f2798c and classified as high 8.1. Affected is the extract_mtp_heads function of the qwen-mtp-gguf pipeline component. The manipulation of the argument shard_name (weight_map values of model.safetensors.index.json in the attacker-published MTP source repo) leads to path traversal. It is possible to launch the attack remotely. User interaction is required because the operator must run the conversion pipeline against the attacker's repo.

Technical Details
- Affected file/function: qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py / extract_mtp_heads() at line 610, fed by source_mtp_shards() at lines 337-346
- Vulnerable parameter: weight_map shard filenames of model.safetensors.index.json
- Attack vector: Network
- Privileges required: None
- Trigger condition: the pipeline joins snapshot_dir / shard_name and opens it with safetensors.safe_open without rejecting absolute paths or checking containment; an absolute weight_map value replaces the snapshot prefix and arbitrary local files are read, with tensors under mtp/nextn keys copied into mtp_heads.safetensors and wired into the prepared model index; missing or unparseable paths disclose existence and format via distinct error messages

Impact
- Confidentiality: High (content of safetensors-readable local files is exported into the conversion output; existence/format oracle for arbitrary paths)
- Integrity: High (attacker-controlled tensor data is embedded into the published model artifact)
- Availability: None

CVSS v3.1
Score: 8.1 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Timeline
- Discovered: 2026-10-05
- Vendor notified: 2026-10-05
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Reject absolute paths and '..' segments in index-supplied shard names and verify the resolved path stays inside the snapshot directory (shard_path.resolve().is_relative_to(snapshot_dir.resolve())) before opening.

• Fonte: ⚠️ https://github.com/R6410418/Jackrong-llm-finetuning-guide/issues/16
• Utilizador: Dem0000000 (UID 98743)
• Submissão: 06/10/2026 18h05 (há 14 dias)
• Moderação: 20/10/2026 18h28 (14 days later)
• Estado: Aceite
• Entrada VulDB: 422910 [R6410418 Jackrong-llm-finetuning-guide até ef2b17f2798cd18cd85375080c35a58397ad0d09 MTP weight_map qwen_mtp_gguf_pipeline.py extract_mtp_heads shard_name Travessia de Diretório]
• Pontos: 20