CVE-2026-113743

Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversal

State: Published
Severity: 5.3 Medium
Published: Oct 21, 2026
Updated: Oct 27, 2026
Reserved: Oct 20, 2026

Description

A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-22 Path Traversal

Affected Products

Product	Versions
tt-metalTenstorrent	0.1Affected 0.2Affected 0.3Affected 0.4Affected 0.5Affected 0.6Affected 0.7Affected 0.8Affected 0.9Affected 0.10Affected 0.11Affected 0.12Affected 0.13Affected 0.14Affected 0.15Affected 0.16Affected 0.17Affected 0.18Affected 0.19Affected 0.20Affected 0.21Affected 0.22Affected 0.23Affected 0.24Affected 0.25Affected and 56 more versions

References

VDB-422924 | Tenstorrent tt-metal load_checkpoints.py load_hf_state_dict_filtered path traversalvdb-entrytechnical-description
VDB-422924 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-113743 | CVE Analysis and Reportthird-party-advisory
Submit #1018296 | Tenstorrent tt-metal up to 0.79.0 Path Traversalthird-party-advisory
https://github.com/tenstorrent/tt-metal/issues/59616issue-tracking
https://github.com/tenstorrent/tt-metal/pull/60634issue-trackingpatch
https://github.com/3em0/cve_repo/blob/main/2026/Path_Traversal_in_tt-metal_tt_transformers_load_checkpoints.mdexploit
https://github.com/tenstorrent/tt-metal/commit/4851ccf347f6903c3d819eed60705600386e52c3patch
https://github.com/tenstorrent/tt-metal/releases/tag/v0.81.0-dev20261016patch
https://github.com/tenstorrent/tt-metal/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.