CVE-2026-49114 ONNX symlink-following and path-traversal arbitrary file write
A local attacker can exploit symlink following in ONNX to write arbitrary data to sensitive files, potentially leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-49114?
CVE-2026-49114 is a medium-severity path traversal vulnerability in ONNX, published on 21 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.
Which versions are affected by CVE-2026-49114?
3 open source packages ship an affected version, including onnx. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
onnx PyPI | All versions | 1.21.0 |
onnx PyPI | All versions | 1.21.0 |
onnx PyPI | All versions | 1.21.0 |
Products include Linuxfoundation Onnx.
How do I fix CVE-2026-49114?
Upgrade onnx to 1.21.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-49114 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49114 exists.
Other vulnerabilities in ONNX
- CVE-2025-51480 Path traversal in n/a
- CVE-2024-5187 Arbitrary File Overwrite in download_model_with_test_data in onnx/onnx
- CVE-2026-27489 ONNX: Path Traversal via Symlink
- CVE-2026-34445 ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
- CVE-2026-28500 ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
Sources
Also known as DEBIAN-CVE-2026-49114, ECHO-9c6f-74fc-9d53, GHSA-q56x-g2fj-4rj6, PYSEC-2026-3876, UBUNTU-CVE-2026-49114.