Path Traversal in Tenstorrent Tt-Metal
CVE-2026-113743
A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.81.0-dev20261016 is sufficient to fix this issue. Patch name: 4851ccf347f6903c3d819eed60705600386e52c3. It is suggested to upgrade the affected component.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Tenstorrent Tt-Metal — versions 0.1, 0.10, 0.11
Weakness classification (CWE)
References
- vuldb.com/vuln/422924 (technical-description, vdb-entry)
- vuldb.com/vuln/422924/cti (signature, permissions-required)
- vuldb.com/cve/CVE-2026-113743 (third-party-advisory)
- vuldb.com/submit/1018296 (third-party-advisory)
- github.com/tenstorrent/tt-metal/issues/59616 (issue-tracking)
- github.com/tenstorrent/tt-metal/pull/60634 (issue-tracking, patch)
- github.com/3em0/cve_repo/blob/main/2026/Path_Traversal_in_tt-metal_tt_transform… (exploit)
- github.com/tenstorrent/tt-metal/commit/4851ccf347f6903c3d819eed60705600386e52c3 (patch)
- github.com/tenstorrent/tt-metal/releases/tag/v0.81.0-dev20261016 (patch)
- github.com/tenstorrent/tt-metal/ (product)
Frequently asked questions
- What is CVE-2026-113743?
- CVE-2026-113743 is a medium-severity vulnerability in Tenstorrent Tt-Metal, classified under Path Traversal. CVSS score: 6.3/10. Published 2026-10-21.
- How severe is CVE-2026-113743?
- Medium severity. CVSS v3 base score is 6.3 out of 10.