{"vulnerability": "cve-2026-58116", "sightings": [{"uuid": "53eb620f-d2ad-4b3a-89cb-5e062b549717", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58116", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpj6n3wm232o", "content": "CVE-2026-58116 - LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path\nCVE ID : CVE-2026-58116\n \n Published : June 30, 2026, 12:54 p.m. | 51\u00a0minutes ago\n \n Description : LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers w...", "creation_timestamp": "2026-06-30T14:11:20.058394Z"}, {"uuid": "c3d9afe6-0ff1-4492-bffc-ed2522165408", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58116", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mpn5sja33323", "content": "\ud83d\udccc CVE-2026-58116 - LLaMA-Factory through 0.9.5 contains a remote code execution vulnerability that allows attackers with WebUI access to execute arbitrary Python code by... https://www.cyberhub.blog/cves/CVE-2026-58116", "creation_timestamp": "2026-07-02T04:07:07.085891Z"}, {"uuid": "b4800b96-7654-49f4-b827-a5b281f0b0cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58116", "type": "seen", "source": "https://bsky.app/profile/ctsd-gmbh.bsky.social/post/3mpvsgs3lyy2r", "content": "CVE-2026-58116 in Propriet\u00e4re KI: Wenn Trainingsdaten zum Risiko werden\n\nJetzt lesen: https://www.ctsd.de/insights/2026-07-ki-propriet-re-ki-wenn-trainingsdaten-zum-risiko-werden.html\n\n#ITSecurity #Co\u2026\n\nhttps://www.ctsd.de/insights/2026-07-ki-propriet-re-ki-wenn-trainingsdaten-zum-risiko-werden.html", "creation_timestamp": "2026-07-05T14:37:40.203374Z"}, {"uuid": "0a3f74aa-8517-452c-bdaa-cb59d9b2c29a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58116", "type": "seen", "source": "https://t.me/GithubRedTeam/91565", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a llama-factory-webui-rce-cve-2026-58116-trust-remote-code-model-path-injection\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hunt-Benito\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-02 07:07:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:15.416161Z"}, {"uuid": "26650ef2-e59f-4159-b5f2-13958aecbb59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58116", "type": "seen", "source": "https://t.me/GithubRedTeam/91565", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a llama-factory-webui-rce-cve-2026-58116-trust-remote-code-model-path-injection\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hunt-Benito\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-02 07:07:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:32.197225Z"}, {"uuid": "a14ace0b-6fd5-4e72-b91e-2173801cfb36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58116", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/91565", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a llama-factory-webui-rce-cve-2026-58116-trust-remote-code-model-path-injection\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hunt-Benito\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-02 07:07:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:27.601106Z"}]}