CVE-2026-49114: ONNX symlink-following and path-traversal arbitrary file write
In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorizedkeys, cron files, or application configs. Fixed in 1.21.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ONNXto a version that resolves this vulnerability.Fixed in 1.21.0 - Compensating control
Ensure the directory used by ONNX to serialize external data is not writable by untrusted/local attackers (restrict write permissions/ownership so symlink pre-planting is not possible).
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of ONNX versions before 1.21.0 are exposed when a victim serializes external model data into a directory that an attacker can write to. The impact is limited to files that the victim process has permission to write.
What must an attacker do to exploit it?
The attacker needs local write access to the directory used for external-data serialization and must pre-create a symlink at the external-data location path. When the victim calls save_external_data, ONNX can follow that symlink and append data to the attacker-selected writable target.
Is user interaction required?
Yes. A victim must serialize external data using the vulnerable save_external_data function after the attacker has planted the symlink. The attacker does not need privileges on the victim's account, but exploitation depends on access to a shared or attacker-writable output directory.
What can be done if upgrading is not immediately possible?
Do not serialize external data into directories writable by untrusted users. Use a directory owned and writable only by the process or account performing serialization, and validate or remove unexpected symlinks before writing.
How is the issue fixed?
Upgrade ONNX to version 1.21.0 or later. This version addresses the unsafe external-data path handling described in the advisory.