Jackrong Finetuning Guide CVE-2026-113738

Exploitation requires that a victim invoke the extract_mtp_heads function in qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py against an attacker-influenced MTP weight_map whose shard_name value contains path-traversal sequences; the flaw is in the MTP weight_map Handler's handling of the shard_name argument. The key limiting factors are: user interaction is required (CVSS UI:P - a victim must run the pipeline on the crafted input), impact is limited to low confidentiality/integrity/availability, and there is no network-facing service implied - the 'remote' characterization most plausibly means delivery of a malicious model artifact rather than exploitation of a listening endpoint. No authentication is required per PR:N, but the dependence on local pipeline execution of untrusted input substantially narrows realistic exploitation.

This is a genuinely low-priority issue despite being a path traversal (CWE-22) with a publicly available PoC. The vendor-assigned CVSS 4.0 score is only 2.1, consistent with its low impact metrics (VC:L/VI:L/VA:L) and the UI:P requirement meaning exploitation is not fully autonomous - a user must process attacker-controlled input for the malicious shard_name to be parsed by extract_mtp_heads. It is NOT in CISA KEV, so there is no confirmed active exploitation, and no EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified. The description's claim that the attack can be 'initiated remotely' conflicts with the actual mechanism: a path-traversal via a weight_map shard_name in a local Python finetuning pipeline is realistically a case of processing a crafted/malicious model artifact, not a network service - verify the true attack vector before treating this as a remote-exploitable flaw. Signals are consistent overall (low CVSS, PoC-only, no KEV), and the dominant risk driver is deployment footprint: this is an obscure personal GitHub guide repository with negligible production presence, so real-world risk is minimal.

An attacker publishes or supplies a crafted model/weight artifact whose weight_map contains a shard_name with directory-traversal sequences (e.g. ../../). When a victim runs the qwen_mtp_gguf_pipeline.py extraction on that artifact, the unsanitized shard_name causes file reads or writes outside the intended directory. A public PoC (poc.zip) exists, but exploitation depends on the victim processing the attacker-supplied input (UI:P).