Symlink Traversal Vulnerability in Open Neural Network Exchange (ONNX)
CVE-2026-34447

5.5MEDIUM

Key Information:

Vendor

Onnx

Status
Onnx
Vendor
CVE Published:
1 April 2026

What is CVE-2026-34447?

The Open Neural Network Exchange (ONNX) framework, utilized for enhancing machine learning model interoperability, contains a symlink traversal vulnerability prior to version 1.21.0. This security flaw allows attackers to exploit the external data loading functionality, enabling them to read files beyond the designated model directory. The vulnerability has been effectively addressed in version 1.21.0, underscoring the importance of updating to the latest version to maintain security.

Affected Version(s)

onnx < 1.21.0

References

https://github.com/onnx/onnx/security/advisories/GHSA-p43...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.