8.8Alta
CVE-2025-51480
Descripción
Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted external_data.location paths containing traversal sequences, bypassing intended directory restrictions.
Debilidad (CWE):
CWE-22
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| linuxfoundation | onnx | 1.17.0 |
Referencias y parches
- https://github.com/onnx/onnx Product
- https://github.com/onnx/onnx/pull/6959 ExploitIssue TrackingPatchVendor Advisory
- https://github.com/advisories/GHSA-6rq9-53c3-f7vj Not Applicable
- https://github.com/onnx/onnx/pull/7040 ExploitIssue TrackingPatchVendor Advisory
- https://www.gecko.security/blog/cve-2025-51480 ExploitThird Party Advisory
Coincidencias CPE (NVD) (1)
cpe:2.3:a:linuxfoundation:onnx:1.17.0:*:*:*:*:*:*:*