CVE-2026-126995: Jlama: path traversal via weight_map in SafeTensorIndex

MEDIUM

Published November 12, 2026

CISO Take

Jlama, a Java library for running LLM inference locally, has a path traversal flaw in SafeTensorIndex.loadWeights: a crafted weight_map entry in a model index file can point the loader at files outside the intended model directory. A public proof-of-concept is linked in the references (a poc.zip attached to the upstream GitHub issue), and the maintainers have not responded to the issue report. There is no fixed version, EPSS data is unavailable and the CVE is not in CISA KEV, so there is no evidence of active exploitation. The CVSS vector is 6.3 (medium) and requires user interaction, which in practice means someone must load an attacker-supplied model. Teams embedding Jlama should treat third-party model directories as untrusted input, load models only from verified sources, and run inference in a sandbox with a restricted filesystem until upstream ships a fix.

Sources:NVDATLASvuldb.comGitHub (tjake/Jlama issue #211)

What is the risk?

Medium overall (CVSS 6.3, low confidentiality, integrity and availability impact, user interaction required). Exploitability is raised by the public PoC and low attack complexity, but the attack depends on a victim loading a malicious model or index file. EPSS is unavailable, the CVE is not in KEV, and the package is niche with unknown downstream adoption. The maintainer is unresponsive and no patch exists, so exposure persists for any affected deployment. Risk is highest where Jlama loads models pulled from public hubs or user-supplied uploads.

How does the attack unfold?

Initial Access

The attacker distributes a model repository or archive with a crafted weight_map in its safetensors index file.

AML.T0010.003

Execution

The victim or pipeline loads the model and SafeTensorIndex.loadWeights resolves the traversal paths without validation.

AML.T0011.000

Collection

Files outside the model directory are opened or referenced by the Jlama process.

AML.T0037

Impact

Unintended file access, corrupted model loading or service disruption on the inference host.

Initial Access

The attacker distributes a model repository or archive with a crafted weight_map in its safetensors index file.

AML.T0010.003

Execution

The victim or pipeline loads the model and SafeTensorIndex.loadWeights resolves the traversal paths without validation.

AML.T0011.000

Collection

Files outside the model directory are opened or referenced by the Jlama process.

AML.T0037

Impact

Unintended file access, corrupted model loading or service disruption on the inference host.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jlama	—	—	No patch

Do you use Jlama? You're affected.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) Check the Jlama GitHub issue #211 and the releases page for a fix and upgrade as soon as one is published; no patched version is currently known. 2) Load models only from trusted, verified sources and pin checksums for model files and index JSON. 3) Before loading, validate model index files and reject weight_map values containing '..', absolute paths or path separators that resolve outside the model directory. 4) Run Jlama in a container or sandbox with a read-only, minimal filesystem and no access to secrets, keys or credentials. 5) Run the process as an unprivileged user and restrict network egress. 6) Monitor for unexpected file access by the JVM process and for model directories containing unusual index files. 7) Consider a small wrapper or patch that canonicalizes and checks resolved paths against the model root.

How is it classified?

Supply ChainData LeakageInferenceFrameworkModelAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0037- Data from Local System

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Risk treatment and response for AI system components

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-126995?

Is CVE-2026-126995 actively exploited?

No confirmed active exploitation of CVE-2026-126995 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-126995?

1) Check the Jlama GitHub issue #211 and the releases page for a fix and upgrade as soon as one is published; no patched version is currently known. 2) Load models only from trusted, verified sources and pin checksums for model files and index JSON. 3) Before loading, validate model index files and reject weight_map values containing '..', absolute paths or path separators that resolve outside the model directory. 4) Run Jlama in a container or sandbox with a read-only, minimal filesystem and no access to secrets, keys or credentials. 5) Run the process as an unprivileged user and restrict network egress. 6) Monitor for unexpected file access by the JVM process and for model directories containing unusual index files. 7) Consider a small wrapper or patch that canonicalizes and checks resolved paths against the model root.

What systems are affected by CVE-2026-126995?

This vulnerability affects the following AI/ML architecture patterns: Model serving, Local LLM inference, Java-based ML applications, Model loading pipelines.

What is the CVSS score for CVE-2026-126995?

CVE-2026-126995 has a CVSS v3.1 base score of 6.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

Model servingLocal LLM inferenceJava-based ML applicationsModel loading pipelines

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0037Data from Local System

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A vulnerability was found in tjake Jlama up to 0.8.4/0.9.0-beta. Affected by this vulnerability is the function SafeTensorIndex.loadWeights of the file jlama-core/src/main/java/com/github/tjake/jlama/safetensors/SafeTensorIndex.java. Performing a manipulation of the argument weight_map results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker publishes a model repository or archive that looks legitimate but whose model.safetensors.index.json contains weight_map entries with traversal sequences such as ../../ pointing at files outside the model directory. A developer or an automated pipeline downloads the model and loads it with Jlama. SafeTensorIndex.loadWeights resolves the attacker-controlled paths and opens files outside the model directory, which can cause unintended file access, corrupted model loading or a crash. In a service that lets users upload or select custom models, the attacker can trigger the same behavior remotely against the server.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.