8.8Hoch
CVE-2025-51480
Beschreibung
Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted external_data.location paths containing traversal sequences, bypassing intended directory restrictions.
Schwachstellentyp (CWE):
CWE-22
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| linuxfoundation | onnx | 1.17.0 |
Referenzen und Patches
- https://github.com/onnx/onnx Product
- https://github.com/onnx/onnx/pull/6959 ExploitIssue TrackingPatchVendor Advisory
- https://github.com/advisories/GHSA-6rq9-53c3-f7vj Not Applicable
- https://github.com/onnx/onnx/pull/7040 ExploitIssue TrackingPatchVendor Advisory
- https://www.gecko.security/blog/cve-2025-51480 ExploitThird Party Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:linuxfoundation:onnx:1.17.0:*:*:*:*:*:*:*