← Database

CVE-2022-25882

HIGH CVSS: 7.5 Published: 2023-01-26 Modified: 2026-06-17

Description

Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory, for example "../../../etc/passwd"

Affected Platforms

Linuxfoundation Onnx

Weakness Type

CWE-22, CWE-22, CWE-22

References