Submit #1018296: Tenstorrent tt-metal up to 0.79.0 Path Traversal

A vulnerability was found in Tenstorrent tt-metal up to 0.79.0 and classified as high 7.1. Affected is the load_hf_state_dict_filtered/resolve_file function of the models/tt_transformers/tt/load_checkpoints.py component. The manipulation of the shard filename argument in the model.safetensors.index.json weight_map leads to path traversal. It is possible to launch the attack remotely: a malicious model package distributed like any model repository makes the loader open safetensors files outside the checkpoint directory and load their tensor values into the model state dict. User interaction is required because a victim must run a model bring-up/load against the crafted checkpoint.

Technical Details
- Affected file/function: models/tt_transformers/tt/load_checkpoints.py / load_hf_state_dict_filtered() with inner resolve_file(), lines 72-107 at commit 70f840f46adb (same code present in release v0.79.0); the sibling load_hf_state_dict() at line 33 repeats the pattern
- Vulnerable parameter: weight_map values (shard filenames) of model.safetensors.index.json
- Attack vector: Network
- Privileges required: None
- Trigger condition: a local checkpoint directory whose index file maps a tensor key to "../../victim/external.safetensors" (or an absolute path); os.path.join() passes the traversal to safetensors_safe_open() with only an existence check. Production callers include models/demos/qwen25_vl/tt/model_config.py:121 and models/experimental/exaone45_vl/tt/model_config.py:126

Impact
- Confidentiality: Low (read restricted to safetensors-format files with known tensor names; values surface as model weights, exfiltration needs an inference-side observation channel; path existence is testable via the error oracle)
- Integrity: High (model weights are silently replaced by attacker-chosen tensors read from outside the model directory - weight poisoning/backdoor insertion)
- Availability: None (worst case a failed load, already controlled by the attacker via the shipped package)

CVSS v3.1
Score: 7.1 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Timeline
- Discovered: [unknown]
- Vendor notified: 2026-10-07
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Resolve the joined path and require it to remain inside os.path.realpath(ckpt_dir) (or accept basenames only) in resolve_file(), and apply the same containment in load_hf_state_dict(); reject shard filenames that escape the checkpoint directory with a clear error.

• Source: ⚠️ https://github.com/tenstorrent/tt-metal/issues/59616
• User: Dem0000000 (UID 98743)
• Submission: 10/07/2026 10:00 (13 days ago)
• Moderation: 10/20/2026 18:44 (13 days later)
• Status: Accepted
• VulDB entry: 422924 [Tenstorrent tt-metal up to 0.80.0 load_checkpoints.py load_hf_state_dict_filtered weight_map path traversal]
• Points: 20