8.8High
CVE-2025-51480
Description
Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted external_data.location paths containing traversal sequences, bypassing intended directory restrictions.
Weakness (CWE):
CWE-22
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| linuxfoundation | onnx | 1.17.0 |
References and patches
- https://github.com/onnx/onnx Product
- https://github.com/onnx/onnx/pull/6959 ExploitIssue TrackingPatchVendor Advisory
- https://github.com/advisories/GHSA-6rq9-53c3-f7vj Not Applicable
- https://github.com/onnx/onnx/pull/7040 ExploitIssue TrackingPatchVendor Advisory
- https://www.gecko.security/blog/cve-2025-51480 ExploitThird Party Advisory
CPE matches (NVD) (1)
cpe:2.3:a:linuxfoundation:onnx:1.17.0:*:*:*:*:*:*:*