CVE-2026-34447CWE-22CWE-61

ONNX: External Data Symlink Traversal

Medium · published April 1, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
8.3
In the wild
Unconfirmed
What it is

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal vulnerability in external data loading allows reading files outside the model directory. This issue has been patched in version 1.21.0.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00191 · 8.3th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2026-04-01T17:39Z
EPSS history
Timeline
  • 01 APR 17:39Z
    ONNX: External Data Symlink Traversal
    cvelistv5