CVE-2026-126995

MEDIUM 6.3

tjake Jlama SafeTensorIndex.java SafeTensorIndex.loadWeights path traversal

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was found in tjake Jlama up to 0.8.4/0.9.0-beta. Affected by this vulnerability is the function SafeTensorIndex.loadWeights of the file jlama-core/src/main/java/com/github/tjake/jlama/safetensors/SafeTensorIndex.java. Performing a manipulation of the argument weight_map results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-22
Vendor	tjake
Product	jlama
Published	Nov 12, 2026

Stay Ahead of the Next One

Get instant alerts for tjake jlama

Be the first to know when new medium vulnerabilities affecting tjake jlama are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

tjake / Jlama

0.8.0 0.8.1 0.8.2 0.8.3 0.8.4 0.9.0-beta

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/436294 vuldb.com: https://vuldb.com/vuln/436294/cti vuldb.com: https://vuldb.com/cve/CVE-2026-126995 vuldb.com: https://vuldb.com/submit/1040636 github.com: https://github.com/tjake/Jlama/issues/211 github.com: https://github.com/user-attachments/files/33599742/poc.zip github.com: https://github.com/tjake/Jlama/

Credits

🔍 Dem00000 (VulDB User) VulDB CNA Team