CVE-2026-117510— Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal

Quick assessment

Affected

Dexmal Dexbotic

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Dexmal Dexbotic 0.2.0 及更早版本中发现了一个安全漏洞。该漏洞影响文件中组件（Checkpoint Loader）的函数。攻击者可通过操纵该函数的参数触发路径遍历漏洞。此漏洞可被远程利用，相关利用代码已经公开并可能被恶意使用。项目方已通过问题报告提前获知该漏洞，但截至目前尚未作出回应。

CVSS 6.3 · Medium Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Dexmal Dexbotic gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t path traversal

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load_pretrained_gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic_arch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weight_map causes path traversal. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Dexmal	Dexbotic	0.1	`cpe:2.3:a:dexmal:dexbotic::::::::`

II. Public POCs for CVE-2026-117510

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-117510

请登录查看更多情报信息。

Other References for CVE-2026-117510 (7)

https://github.com/dexmal/dexbotic/issues/103 issue-tracking
https://github.com/dexmal/dexbotic/ product
https://github.com/user-attachments/files/33302686/poc.zip exploit
https://vuldb.com/cve/CVE-2026-117510 third-party-advisory
https://vuldb.com/vuln/427076/cti signature permissions-required
https://vuldb.com/submit/1024532 third-party-advisory
https://vuldb.com/vuln/427076 vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-117510

IV. Related Vulnerabilities

Same weakness: CWE-22