CVE-2026-113743

MEDIUM 6.3

Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.

CWE	CWE-22
Vendor	tenstorrent
Product	tt-metal
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for tenstorrent tt-metal

Be the first to know when new medium vulnerabilities affecting tenstorrent tt-metal are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Tenstorrent / tt-metal

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 0.10 0.11 0.12 0.13 0.14 0.15 0.16 0.17 0.18 0.19 0.20 0.21 0.22 0.23 0.24 0.25 0.26 0.27 0.28 0.29 0.30 0.31 0.32 0.33 0.34 0.35 0.36 0.37 0.38 0.39 0.40 0.41 0.42 0.43 0.44 0.45 0.46 0.47 0.48 0.49 0.50 0.51 0.52 0.53 0.54 0.55 0.56 0.57 0.58 0.59 0.60 0.61 0.62 0.63 0.64 0.65 0.66 0.67 0.68 0.69 0.70 0.71 0.72 0.73 0.74 0.75 0.76 0.77 0.78 0.79 0.80.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/422924 vuldb.com: https://vuldb.com/vuln/422924/cti vuldb.com: https://vuldb.com/cve/CVE-2026-113743 vuldb.com: https://vuldb.com/submit/1018296 github.com: https://github.com/tenstorrent/tt-metal/issues/59616 github.com: https://github.com/tenstorrent/tt-metal/pull/60634 github.com: https://github.com/3em0/cve_repo/blob/main/2026/Path_Traversal_in_tt-metal_tt_transformers_load_checkpoints.md github.com: https://github.com/tenstorrent/tt-metal/commit/4851ccf347f6903c3d819eed60705600386e52c3 github.com: https://github.com/tenstorrent/tt-metal/releases/tag/v0.81.0-dev20261016 github.com: https://github.com/tenstorrent/tt-metal/

Credits

🔍 Dem0000000 (VulDB User)