ONNX Directory Traversal Vulnerability Affects Previous Versions

CVE-2024-27318

What is CVE-2024-27318?

The ONNX package, utilized in various machine learning frameworks, has a Directory Traversal vulnerability related to the external_data field within tensor proto files. This vulnerability allows an attacker to specify a file path that can bypass the intended restrictions, potentially leading to unauthorized access to files outside the designated directories. This issue exists in versions up to and including 1.15.0 and represents a failure to adequately mitigate exposure, particularly due to its ineffectiveness against previously addressed vulnerabilities, such as CVE-2022-25882. Users and administrators should prioritize updates to mitigate potential impacts.

References