CVE-2025-51480

Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted external_data.location paths containing traversal sequences, bypassing intended directory restrictions.

Score

CVSS 3.1 8.8 High

Status

Analyzed - cve@mitre.org

Published

2025-07-22

Last modified

2025-07-22

Weaknesses

CWE-22

Affected products

• Onnx (Linuxfoundation)

References

• https://github.com/advisories/GHSA-6rq9-53c3-f7vj
• https://github.com/onnx/onnx
• https://github.com/onnx/onnx/pull/6959
• https://github.com/onnx/onnx/pull/7040
• https://www.gecko.security/blog/cve-2025-51480