CVE-2026-113737

Name of the Vulnerable Software and Affected Versions Jackrong-llm-finetuning-guide versions up to ef2b17f2798cd18cd85375080c35a58397ad0d09

Description A remote path traversal issue exists in the validate indexed tensors() function within the qwen-mtp-gguf/scripts/qwen mtp gguf pipeline.py file. This occurs when the weight map argument is manipulated, allowing an attacker to access files or directories outside the intended folder.

Recommendations As a temporary workaround, restrict the use of the weight map argument in the validate indexed tensors() function until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.