Skip to content
fr Sign in
7.5 High

CVE-2024-27318 Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data…

Description

Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882.

Affected products and versions

Product Affected versions Fixed in
onnx 1.15 earliest → 1.15.0 No fix stated
onnx 1.15 earliest → 1.15.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of onnx

The 14 CVEs of onnx →
CVE-2026-115922 Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability 6.2 Medium CVE-2026-115921 Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability 6.2 Medium CVE-2026-115920 Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability 6.2 Medium CVE-2026-115919 Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability 6.2 Medium
Track this CVE