Path traversal in onnx - #VU128172

Detailed vulnerability description

The vulnerability allows a remote attacker to write files outside the intended directory on Windows systems.

The vulnerability exists due to path traversal in save_external_data in onnx.external_data_helper.py when validating external data file paths on Windows systems. A remote attacker can supply a crafted absolute path to write files outside the intended directory on Windows systems.

This issue is described as a potential validation bypass and was not fully verified in the advisory.

Remediation

Sources

• https://github.com/onnx/onnx/security/advisories/GHSA-q56x-g2fj-4rj6
• https://github.com/advisories/GHSA-q56x-g2fj-4rj6