EUVD-2026-107030
GHSA-xwr8-qcf8-4867
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious checkpoint with traversal in weight_map
-
ExploitVictim loads checkpoint via tt_transformers loader
-
ExecutionPath join escapes checkpoint directory
-
ImpactRead/load file outside intended directory
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load an attacker-controlled or untrusted checkpoint directory whose model.safetensors.index.json 'weight_map' entries contain relative ('../') or absolute paths that escape the checkpoint directory; the vulnerable call is load_hf_state_dict_filtered in models/tt_transformers/tt/load_checkpoints.py, which joined these filenames onto the checkpoint dir without containment checking. Limiting factors: the attack is gated by user interaction (UI:P) - someone must actually load the malicious checkpoint - and impact is read-oriented (a shard pulled from outside the directory), not direct code execution; it only affects environments running tt-metal up to 0.80.0 that load externally sourced checkpoints. |
| Impact | This is a low-priority issue despite being remotely reachable. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P, all impacts Low, no scope change) yields a base score of only 2.1, and the SSVC exploitation sub-metric in the vector is E:P (proof-of-concept), consistent with the stated public POC rather than active exploitation. No EPSS score was provided and the CVE is NOT on CISA KEV, so there is no evidence of in-the-wild use. The one notable tension is AV:N combined with UI:P: the flaw lives in local checkpoint-loading code (load_hf_state_dict_filtered reading weight_map from model.safetensors.index.json), so 'remote' realistically means the attacker supplies a malicious model/checkpoint that a victim then loads - it is not unauthenticated server-side RCE. Net: a real but minor supply-chain-style path-traversal bug in a niche AI accelerator framework; patch during normal maintenance, not an emergency. |
| Exploit ScenarioDerived | An attacker publishes or otherwise delivers a malicious HuggingFace-style checkpoint whose model.safetensors.index.json weight_map contains traversal entries (e.g. '../../etc/...' or an absolute path). When a tt-metal user loads that checkpoint via load_hf_state_dict_filtered, the loader joins the untrusted filename onto the checkpoint directory and reads a file outside it. A public POC exists (3em0/cve_repo write-up), lowering the barrier, but exploitation still requires the victim to load the attacker-controlled checkpoint (UI:P). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Path traversal in Tenstorrent tt-metal up to and including 0.80.0 lets a malicious model checkpoint direct the loader to read a safetensors shard from outside the checkpoint directory, because weight_map filenames in model.safetensors.index.json are joined onto the checkpoint path without containment checking. The weakness is reachable remotely but gated by user interaction: someone must actually load an untrusted or attacker-supplied checkpoint, and the impact is read-oriented (an out-of-directory shard is pulled into the loaded state dict) rather than direct code execution, which is why the assessed severity is low (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N; upstream CVSS 4.0 score 2.1). Publicly available exploit code exists and the vendor has released a fix in v0.81.0-dev20261016; there is no indication of confirmed active exploitation (CISA KEV).
RemediationAI
Upgrade tt-metal to v0.81.0-dev20261016 or later (release tag https://github.com/tenstorrent/tt-metal/releases/tag/v0.81.0-dev20261016); the fix is upstream commit 4851ccf347f6903c3d819eed60705600386e52c3, delivered via PR https://github.com/tenstorrent/tt-metal/pull/60634, which adds a lexical abspath/commonpath containment check (_checkpoint_file_path) plus a check_checkpoint_index pre-flight that runs before transformers.from_pretrained. If upgrading is not immediately possible, only load checkpoints whose model.safetensors.index.json weight_map values are bare filenames verified not to contain '..' segments or absolute paths - this is cheap to script and blocks the traversal exactly, but it must be applied to every checkpoint including cached snapshots or the protection is bypassed. Restrict the checkpoint directory to a location whose parent contains nothing sensitive and run the loading process with read-only, least-privilege filesystem access (container or sandbox), accepting that this constrains legitimate access to the model cache but limits what an escaping shard path can reach. Do not rely on HF cache symlink layout as a mitigation; the fix deliberately allows those symlinks, so symlink presence is not a trustworthy indicator of a malicious index.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
tt-metal is Tenstorrent's low-level software stack for its AI accelerators, and its model-loading helpers in load_checkpoints.py support Hugging Face-style sharded checkpoints. A sharded HF checkpoint ships a model.safetensors.index.json whose 'weight_map' maps tensor names to shard filenames; the vulnerable code did os.path.join(ckpt_dir, file) on each entry from that index with no validation, which is the classic CWE-22 path traversal pattern - an entry such as '../../outside.safetensors' or an absolute path resolves outside the intended checkpoint root. The upstream fix (commit 4851ccf, PR 60634) introduces a _checkpoint_file_path helper that computes os.path.abspath of the joined path and rejects anything whose os.path.commonpath with the checkpoint root is not the root itself, explicitly using abspath rather than realpath so that legitimate Hugging Face cache snapshots (which are symlinks into ../../blobs) continue to load. The fix also adds check_checkpoint_index, called before transformers' from_pretrained on local checkpoints, because from_pretrained independently follows escaping weight_map entries and because the per-layer load path could swallow a ValueError and fall back to from_pretrained. The weakness is a trust-boundary problem: tt-metal assumes the checkpoint index is honest, while the index is attacker-controlled data whenever a model is pulled from an untrusted source.
Know when Tt Metal gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Attacker supplies a malicious checkpoint but the victim must load it (UI:R); no privileges needed (PR:N); traversal reads a file outside the dir giving limited confidentiality/integrity impact, no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB