Path Traversal Vulnerability in lxtGH OMG-Seg Product
CVE-2026-124589

5.3MEDIUM

Key Information:

Vendor

Lxtgh

Status
Omg-seg
Vendor
CVE Published:
9 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-124589?

A weakness has been discovered in the lxtGH OMG-Seg product, specifically within the MoE Shard Checkpoint Loader's method load_state_dict_into_model. This vulnerability arises from improper handling of the argument weight_map, potentially allowing attackers to traverse file paths and access restricted files. The attack can be executed remotely, increasing the risk exposure. The issue was reported to the developers, yet no response has been provided, leaving users vulnerable. It's essential for users to apply necessary mitigations or patches as soon as they become available.

Affected Version(s)

OMG-Seg f3b26b609bae919760cd3ccf09c36179bb8624a0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-124589 - Proof of Concept

References

https://vuldb.com/vuln/433013
vdb-entrytechnical-description
https://vuldb.com/vuln/433013/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124589
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dem00000 (VulDB User)
VulDB CNA Team
.