CVE-2024-27318: Path Traversal
Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the externaldata field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The vulnerability occurs as a bypass for the patch added for CVE-2022-25882.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27318?
CVE-2024-27318 has been classified with moderate severity due to its potential for directory traversal exploitation.
How do I fix CVE-2024-27318?
To mitigate CVE-2024-27318, upgrade the onnx package to version 1.16.0 or later.
Which versions of onnx are affected by CVE-2024-27318?
CVE-2024-27318 affects all versions of the onnx package up to and including 1.15.0.
What is the nature of the vulnerability in CVE-2024-27318?
CVE-2024-27318 involves a directory traversal vulnerability that allows access to files outside the designated directories.
Is there a risk of data leakage with CVE-2024-27318?
Yes, CVE-2024-27318 may lead to unauthorized file access, posing a risk of data leakage.