CVE-2026-117510

Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal

State: Published
Severity: 5.3 Medium
Published: Oct 27, 2026
Updated: Oct 27, 2026
Reserved: Oct 27, 2026

Description

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load_pretrained_gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic_arch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weight_map causes path traversal. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C	VulDB
2.0	7.5 High	AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C	VulDB

Weaknesses

CWE-22 Path Traversal

Affected Products

Product	Versions
DexboticDexmal	0.1Affected 0.2.0Affected

References

VDB-427076 | Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversalvdb-entrytechnical-description
VDB-427076 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-117510 | CVE Analysis and Reportthird-party-advisory
Submit #1024532 | Dexmal Dexbotic commit 21db59bace4cebc05197160adf3a9eccd208b664 Path Traversalthird-party-advisory
https://github.com/dexmal/dexbotic/issues/103issue-tracking
https://github.com/user-attachments/files/33302686/poc.zipexploit
https://github.com/dexmal/dexbotic/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.