| Title | R6410418 Jackrong-llm-finetuning-guide commit ef2b17f2798c Path Traversal |
|---|
| Description | A vulnerability was found in Jackrong-llm-finetuning-guide commit ef2b17f2798c and classified as medium 5.4. Affected is the validate_indexed_tensors function of the qwen-mtp-gguf pipeline component. The manipulation of the argument weight_map in model.safetensors.index.json leads to a path traversal. It is possible to launch the attack remotely. User interaction is required because the operator must run the conversion pipeline on a model repo prepared by the attacker.
Technical Details
- Affected file/function: qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py / validate_indexed_tensors() (lines 544-559), reached from model_has_valid_mtp() and inject_mtp_index()
- Vulnerable parameter: weight_map values of model.safetensors.index.json
- Attack vector: Network
- Privileges required: None
- Trigger condition: the pipeline joins each weight_map value onto the model directory (shard = model_dir / filename at line 552) and opens it with safetensors.safe_open; an absolute value discards the model-dir prefix, so the pipeline opens and validates files at arbitrary absolute paths outside the model package, and line 554 echoes the joined path in FileNotFoundError, giving an existence/format/key-name oracle for arbitrary local paths
Impact
- Confidentiality: Low (existence, safetensors parseability and tensor key names of arbitrary local files are disclosed; tensor values are not exported at this sink)
- Integrity: Low (the attacker-written index passes the pipeline validation gate and enters downstream conversion stages)
- Availability: None
CVSS v3.1
Score: 5.4 (Medium)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Timeline
- Discovered: 2026-10-05
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]
Countermeasure
Reject absolute paths and `..` segments in index-supplied shard names, verify resolved-path containment (is_relative_to the model directory) before opening, and apply the same check at the sibling join in extract_mtp_heads() (line 610). |
|---|
| Source | ⚠️ https://github.com/R6410418/Jackrong-llm-finetuning-guide/issues/15 |
|---|
| User | Dem0000000 (UID 98743) |
|---|
| Submission | 10/06/2026 18:04 (14 days ago) |
|---|
| Moderation | 10/20/2026 18:28 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422909 [R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09 qwen_mtp_gguf_pipeline.py validate_indexed_tensors weight_map path traversal] |
|---|
| Points | 20 |
|---|