Medium severity · published Apr 1, 2026
CVE-2026-34446
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is an issue in onnx.load, the code checks for symlinks to prevent path traversal, but completely misses hardlinks because a hardlink looks exactly like a regular file on the filesystem. This issue has been patched in version 1.21.0.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
onnx · onnx
< 1.21.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34446
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34446
Patch
https://github.com/onnx/onnx/commit/4755f8053928dce18a61db8fec71b69c74f786cb
Vendor Advisory
https://github.com/onnx/onnx/security/advisories/GHSA-cmw6-hcpp-c6jp
More from onnx
9.1
CVE-2024-7776
A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention…
8.6
CVE-2026-34445
ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
7.5
CVE-2026-27489
ONNX: Path Traversal via Symlink
7.1
CVE-2026-49114
ONNX symlink-following and path-traversal arbitrary file write
6.2
CVE-2026-115922
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs