Description (CNA)
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Tenstorrent / tt-metal | affected 0.1; affected 0.2; affected 0.3; affected 0.4; affected 0.5; affected 0.6; affected 0.7; affected 0.8; affected 0.9; affected 0.10; affected 0.11; affected 0.12; affected 0.13; affected 0.14; affected 0.15; affected 0.16; affected 0.17; affected 0.18; affected 0.19; affected 0.20; affected 0.21; affected 0.22; affected 0.23; affected 0.24; affected 0.25; affected 0.26; affected 0.27; affected 0.28; affected 0.29; affected 0.30; affected 0.31; affected 0.32; affected 0.33; affected 0.34; affected 0.35; affected 0.36; affected 0.37; affected 0.38; affected 0.39; affected 0.40; affected 0.41; affected 0.42; affected 0.43; affected 0.44; affected 0.45; affected 0.46; affected 0.47; affected 0.48; affected 0.49; affected 0.50; affected 0.51; affected 0.52; affected 0.53; affected 0.54; affected 0.55; affected 0.56; affected 0.57; affected 0.58; affected 0.59; affected 0.60; affected 0.61; affected 0.62; affected 0.63; affected 0.64; affected 0.65; affected 0.66; affected 0.67; affected 0.68; affected 0.69; affected 0.70; affected 0.71; affected 0.72; affected 0.73; affected 0.74; affected 0.75; affected 0.76; affected 0.77; affected 0.78; affected 0.79; affected 0.80.0; unaffected 0.81.0-dev20261016 |
CWE
CWE-22
References
- https://vuldb.com/vuln/422924
- https://vuldb.com/vuln/422924/cti
- https://vuldb.com/cve/CVE-2026-113743
- https://vuldb.com/submit/1018296
- https://github.com/tenstorrent/tt-metal/issues/59616
- https://github.com/tenstorrent/tt-metal/pull/60634
- https://github.com/3em0/cve_repo/blob/main/2026/Path_Traversal_in_tt-metal_tt_transformers_load_checkpoints.md
- https://github.com/tenstorrent/tt-metal/commit/4851ccf347f6903c3d819eed60705600386e52c3
- https://github.com/tenstorrent/tt-metal/releases/tag/v0.81.0-dev20261016
- https://github.com/tenstorrent/tt-metal/