High severity · published Aug 21, 2026
CVE-2026-49114
ONNX symlink-following and path-traversal arbitrary file write
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ON
ONNX · ONNX
before 1.21.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49114
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-49114
Exploit
https://github.com/onnx/onnx/security/advisories/GHSA-q56x-g2fj-4rj6
VDB Entry
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-233-01.json
Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-49114
More from ONNX
9.1
CVE-2024-7776
A vulnerability in the `download_model` function of the onnx/onnx framework, before and including version 1.16.1, allows for arbitrary file overwrite due to inadequate prevention…
8.6
CVE-2026-34445
ONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
7.5
CVE-2026-27489
ONNX: Path Traversal via Symlink
6.2
CVE-2026-115922
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
6.2
CVE-2026-115921
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute