CVE-2026-124589— lxtGH OMG-Seg MoE Shard Checkpoint Loader handle_moe_load_and_save.py load_state_dict_into_model path traversal

Quick assessment

Affected

lxtGH OMG-Seg

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 lxtGH OMG-Seg 项目（截至提交哈希 f3b26b609bae919760cd3ccf09c36179bb8624a0）中发现了一个安全弱点。该问题影响文件中的函数，该函数属于 MoE 分片检查点加载器组件。攻击者可通过恶意操纵参数，触发路径遍历漏洞。此攻击可远程实施，且利用代码已在公开渠道发布，可能被用于实际攻击。由于该项目未采用版本控制机制，因此无法提供受影响或不受影响的具体版本信息。项目方已通过问题报告在早期获知此漏洞，但截至目前尚未作出回应。

CVSS 6.3 · Medium Updated Nov 09, 2026

Possible ATT&CK Techniques 2 AI

T1588 · Obtain Capabilities T1201 · Password Policy Discovery

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

lxtGH OMG-Seg MoE Shard Checkpoint Loader handle_moe_load_and_save.py load_state_dict_into_model path traversal

Source: CVE Program / CVE List V5

Vulnerability Description

A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function load_state_dict_into_model of the file omg_llava/xtuner/utils/handle_moe_load_and_save.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weight_map can lead to path traversal. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
lxtGH	OMG-Seg	f3b26b609bae919760cd3ccf09c36179bb8624a0	`cpe:2.3:a:lxtgh:omg-seg::::::::`

II. Public POCs for CVE-2026-124589

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124589

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-124589 (1)

CVE-2026-124589 | lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0 MoE Shard Checkpoint Loader handle_moe_load_and_save.py load_state_dict_into_model weight_map path traversal (Issue 78) vdb-entry technical-description

Other References for CVE-2026-124589 (6)

https://github.com/lxtGH/OMG-Seg/ product
https://github.com/lxtGH/OMG-Seg/issues/78 issue-tracking
https://github.com/user-attachments/files/33587423/poc.zip exploit
https://vuldb.com/cve/CVE-2026-124589 third-party-advisory
https://vuldb.com/vuln/433013/cti signature permissions-required
https://vuldb.com/submit/1040376 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-124589

IV. Related Vulnerabilities

Same weakness: CWE-22