CVE-2026-113738

Name of the Vulnerable Software and Affected Versions Jackrong-llm-finetuning-guide versions up to ef2b17f2798cd18cd85375080c35a58397ad0d09

Description A path traversal issue exists in the MTP weight map Handler component within the extract mtp heads() function of the qwen-mtp-gguf/scripts/qwen mtp gguf pipeline.py file. A remote attacker can exploit this by manipulating the shard name argument to access files or directories outside the intended folder.

Recommendations As a temporary workaround, restrict the use of the extract mtp heads() function until a fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.