CVE-2026-126995: tjake Jlama SafeTensorIndex.java SafeTensorIndex.loadWeights path traversal
A vulnerability was found in tjake Jlama up to 0.8.4/0.9.0-beta. Affected by this vulnerability is the function SafeTensorIndex.loadWeights of the file jlama-core/src/main/java/com/github/tjake/jlama/safetensors/SafeTensorIndex.java. Performing a manipulation of the argument weightmap results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Event History
Frequently Asked Questions
What must an attacker be able to control to exploit this issue?
The attacker needs to manipulate the weight_map argument processed by SafeTensorIndex.loadWeights. Exploitation can be initiated remotely and requires user interaction according to the supplied severity vector.
Which releases are identified as affected?
The issue is reported in tjake Jlama up to version 0.8.4 and 0.9.0-beta.
Is public exploit information available?
Yes. A proof of concept is flagged, and the vulnerability information states that an exploit has been made public.
Is a vendor fix or response available?
No response from the project is reported despite early notification through an issue report. The provided data does not identify a fixed release or workaround.