CVE-2026-27489 Details
Description
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version 1.21.0.
A path traversal vulnerability has been identified in Open Neural Network Exchange (ONNX) versions prior to 1.21.0. This vulnerability allows the reading of arbitrary files outside the model or user-provided directory, through the use of symbolic links. The issue arises because the symlink traversal is not properly validated, enabling models to reference external data files in a way that bypasses security checks.
Users should update to ONNX version 1.21.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:24977 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-27489 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2453929 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27489.json | redhat-SADP | |
| https://github.com/onnx/onnx/commit/4755f8053928dce18a61db8fec71b69c74f786cb | [email protected] | Patch |
| https://github.com/onnx/onnx/security/advisories/GHSA-3r9x-f23j-gc73 | [email protected] | ExploitMitigationPatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | redhat-SADP |
| CWE-23 | Relative Path Traversal | [email protected] |
| CWE-61 | UNIX Symbolic Link (Symlink) Following | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linuxfoundation onnx | < 1.21.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Apr 1, 2026 | New CVE Received | [email protected] |