Jackrong-llm-finetuning-guide CVE-2026-113737

Requires that a victim process an attacker-influenced weight_map argument through the validate_indexed_tensors function in qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py - i.e., the attacker must get a crafted model/weight_map artifact into the victim's GGUF conversion workflow. Limiting factors: the CVSS vector requires passive user interaction (UI:P - the victim must actually run the conversion pipeline) and low-level privileges (PR:L), impact is limited to Low C/I/A with no scope change, and the affected code is a niche script used only by people converting Qwen MTP models to GGUF format, so realistic exposure is narrow.

This is a low-priority, low-real-risk issue despite being remotely reachable. The CVSS 4.0 base score is only 2.0, and the vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L) shows why: exploitation requires at least low-level privileges (PR:L), passive user interaction (UI:P - the victim must run the conversion pipeline on attacker-influenced input), and yields only Low confidentiality, integrity, and availability impact with no scope change. The exploit maturity is marked E:P (proof-of-concept), consistent with the published poc.zip, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no signal of widespread or automated exploitation. Signals are internally consistent - low severity, PoC-only, no active-exploitation evidence - rather than conflicting. The one caveat: the description claims the attack 'may be performed from remote,' yet the flaw lives in a local data-processing function (validate_indexed_tensors operating on a weight_map), so the 'remote' characterization most realistically means an attacker supplies a crafted model/weight_map artifact that a victim then processes - verify the actual delivery path before treating this as truly network-exploitable. The affected product is an obscure individual GitHub repository with negligible production footprint, further lowering practical priority.

An attacker publishes or supplies a malicious model artifact containing a crafted weight_map; a user who runs the qwen-mtp-gguf conversion pipeline on it triggers validate_indexed_tensors, which follows the traversal sequence to read or write files outside the intended directory. A public proof-of-concept (poc.zip) exists, but exploitation is bounded by low impact and the requirement that the victim actively process the attacker's input.