CVE-2026-27489CWE-23CWE-61

ONNX: Path Traversal via Symlink

High · published April 1, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
48.8
In the wild
Unconfirmed
What it is

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00616 · 48.8th percentile
Weaknesses
CWE-23 · Relative Path Traversal; CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-04-01T17:33Z
EPSS history
Timeline
  • 01 APR 17:33Z
    ONNX: Path Traversal via Symlink
    cvelistv5