CVE-2026-34447 MEDIUM

CVE-2026-34447: ONNX: External Data Symlink Traversal

Vendor Onnx
Product onnx
Weakness CWE-61
Published April 1, 2026
Last update April 1, 2026
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal vulnerability in external data loading allows reading files outside the model directory. This issue has been patched in version 1.21.0.

Key dates

02Disclosure timeline

April 1, 2026 CVE published
April 1, 2026 Record updated