A symlink traversal flaw in external data loading allows a user to read files located outside the model directory. The vulnerability can provide access to confidential data that the application has permission to read, potentially exposing sensitive information without requiring higher privileges. The weakness maps to common errors in handling filesystem paths (CWE‑22, CWE‑61).

The flaw exists in the ONNX library, the open‑source standard for machine‑learning model exchange. All releases prior to version 1.21.0 are affected, as the issue is fixed in 1.21.0 and later. Organizations that embed ONNX (clients, servers, or tooling that processes .onnx files) and use an older release are susceptible. No particular commercial vendor is singled out, since ONNX is community‑maintained.

The base CVSS score is 5.5, indicating a moderate risk. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitability depends on how the model is loaded; the attack would likely originate from a local user or a process that can supply model files, which aligns with a local or semi‑remote vector inferred from the description. Defenses include that the flaw does not enable arbitrary code execution—only reads of constrained files—yet an attacker could still gain access to sensitive system files if path traversal succeeds.