Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal vulnerability in external data loading allows reading files outside the model directory. This issue has been patched in version 1.21.0.

Affected: PyPI: onnx

Summary - Issue: Symlink traversal in external data loading allows reading files outside the model directory. - Affected code: `onnx/onnx/checker.cc: resolve_external_data_location` used via Python `onnx.external_data_helper.load_external_data_for_model`. - Impact: Arbitrary file read (confidentiality breach) when a model’s external data path resolves to a symlink targeting a file outside the model directory.

Root Cause - The function `resolve_external_data_location(base_dir, location, tensor_name)` intends to ensure that external data files reside within `base_dir`. It: - Rejects empty/absolute paths - Normalizes the relative path and rejects `..` - Builds `data_path = base_dir / relative_path` - Checks `exists(data_path)` and `is_regular_file(data_path)` - However, `std::filesystem::is_regular_file(path)` follows symlinks to their targets. A symlink placed inside `base_dir` that points to a file outside `base_dir` will pass the checks and be returned. The Python loader then opens the path and reads the target file.

Code Reference - File: onnx/onnx/checker.cc:970-1060 - Key logic: - Normalization: `auto relative_path = file_path.lexically_normal().make_preferred();` - Existence: `std::filesystem::exists(data_path)` - Regular file check: `std::filesystem::is_regular_file(data_path)` - Returned path is later opened in Python: `external_data_helper.load_external_data_for_tensor`.

Proof of Concept (PoC) - File: `onnx_external_data_symlink_traversal_poc.py` -…

Affected: PyPI: onnx

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal vulnerability in external data loading allows reading files outside the model directory. This issue has been patched in version 1.21.0.

Affected: Ubuntu:22.04:LTS: onnx, Ubuntu:Pro:24.04:LTS: onnx, Ubuntu:25.10: onnx, Ubuntu:26.04:LTS: onnx

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal vulnerability in external data loading allows reading files outside the model directory. This issue has been patched in version 1.21.0.