8.8Yüksek
CVE-2025-51480
Açıklama
Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted external_data.location paths containing traversal sequences, bypassing intended directory restrictions.
Zayıflık türü (CWE):
CWE-22
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| linuxfoundation | onnx | 1.17.0 |
Kaynaklar ve yamalar
- https://github.com/onnx/onnx Product
- https://github.com/onnx/onnx/pull/6959 ExploitIssue TrackingPatchVendor Advisory
- https://github.com/advisories/GHSA-6rq9-53c3-f7vj Not Applicable
- https://github.com/onnx/onnx/pull/7040 ExploitIssue TrackingPatchVendor Advisory
- https://www.gecko.security/blog/cve-2025-51480 ExploitThird Party Advisory
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:linuxfoundation:onnx:1.17.0:*:*:*:*:*:*:*