Open Neural Network Exchange (ONNX) versions before 1.21.0 contain a path traversal flaw that allows a malicious model to read files outside of its designated directory. The vulnerability operates by following symbolic links embedded in the model, enabling an attacker to read arbitrary files on the host filesystem, potentially exposing confidential information. The weakness is classified as CWE‑22, CWE‑23 and CWE‑61, which denote path traversal and absolute path traversal errors.

The issue affects the ONNX library from the Linux Foundation. Any deployment of ONNX 1.20.x or earlier is vulnerable, regardless of the host operating system. The vulnerability was patched with version 1.21.0, so only installations that have not updated to that or newer release remain affected.

The CVSS score of 8.7 indicates a high severity, but the EPSS score of less than 1% signifies that the likelihood of exploitation is low at present. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. To exploit it, an attacker would need to supply a malicious ONNX model that contains a symlink pointing to a sensitive file, so the threat is primarily to systems that accept untrusted models without proper validation.