CVE-2026-55832 Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx

What is CVE-2026-55832?

CVE-2026-55832 is a medium-severity path traversal vulnerability in sonos tract, published on 14 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.

Weakness: CWE-22

Which versions are affected by CVE-2026-55832?

6 open source packages ship an affected version, including tract-onnx.

How do I fix CVE-2026-55832?

Upgrade tract-onnx to a fixed version for your release line: 0.21.17, 0.22.3 or 0.23.2.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-55832 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55832 exists.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h668-6x6g-f8r5.