A vulnerability, identified as CVE-2026-126995, affects tjake Jlama versions 0.8.4 and 0.9.0-beta. The issue arises in the SafeTensorIndex.loadWeights function in the SafeTensorIndex.java file, allowing an attacker to perform a path traversal through manipulation of the weightmap argument. This vulnerability can be exploited remotely, with a public exploit available. The affected project has been notified of the issue but has yet to respond.