Arbitrary File Overwrite in download_model_with_test_data in onnx/onnx
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers to overwrite any file on the system, potentially leading to remote code execution, deletion of system, personal, or application files, thus impacting the integrity and availability of the system. The issue arises from the function's handling of tar file extraction without performing security checks on the paths within the tar file, as demonstrated by the ability to overwrite the `/home/kali/.ssh/authorized_keys` file by specifying an absolute path in the malicious tar file.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| onnx | onnx/onnx | up to latest | — | No fix listed | CNA |
| — | onnx (PyPI) | before 1.16.2 | 1.16.2 | Patch available | GHSA-6rq9-53c3-f7vj |
- onnx/onnx Vendoronnx Affected up to latest Fixed in — No fix listed CNA
- onnx (PyPI) Vendor— Affected before 1.16.2 Fixed in 1.16.2 Patch available GHSA-6rq9-53c3-f7vj
Remediation
- Fix · GHSA-6rq9-53c3-f7vj onnx (PyPI) Fixed in 1.16.2 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2024-5187
- 2026-10-03 Alias added: GHSA-6rq9-53c3-f7vj
References
Advisory 2
Other 11
- https://github.com/onnx/onnx/issues/6215
- https://github.com/onnx/onnx/pull/6145
- https://github.com/onnx/onnx/pull/6222
- https://github.com/onnx/onnx/pull/6959
- https://github.com/onnx/onnx/pull/7040
- https://github.com/onnx/onnx/commit/1b70f9b673259360b6a2339c4bd97db9ea6e552f
- https://github.com/onnx/onnx/commit/3fc3845edb048df559aa2a839e39e95503a0ee34
- https://github.com/onnx/onnx
- https://github.com/onnx/onnx/releases/tag/v1.16.2
- https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2025-148.yaml
- https://www.gecko.security/blog/cve-2025-51480
More onnx vulnerabilities
- TI-2026-22763 ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack CVSS 3.1CRITICAL 9.1
- TI-2026-21896 ONNX: Path Traversal via Symlink CVSS 4.0HIGH 8.7
- TI-2024-07209 Arbitrary File Overwrite in onnx/onnx CVSS 3.1CRITICAL 9.1
- TI-2026-36338 ONNX symlink-following and path-traversal arbitrary file write CVSS 4.0MEDIUM 6.8
- TI-2026-32442 ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs) CVSS 3.1MEDIUM 5.5
- TI-2026-26712 ONNX: External Data Symlink Traversal CVSS 3.1MEDIUM 5.5
Sources
- CVE-2024-5187 · CVE Program
- CVE-2024-5187 · NVD
- FIRST EPSS
- GHSA-6rq9-53c3-f7vj · GitHub Advisory Database · CC BY 4.0
- CVE-2024-5187 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences