A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious ta…
CVSS 3.1CRITICAL 9.1·Network·No auth·No interaction·EPSS 0.01532·Published 2025-03-20·Fixed in 1.17.0CWE-22