{"id":"CVE-2026-110657","summary":"Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label","details":"Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or overwrite '.dat' files when users convert, save, or generate weights.","modified":"2026-10-16T02:47:31.985125927Z","published":"2026-10-14T15:01:23.943Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110657.json"},"references":[{"type":"WEB","url":"https://pypi.org"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110657.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110657"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/khronos-nnef-tools-nnef-through-1.0.10-and-nnef-tools-through-1.0.11-path-traversal-via-variable-label"},{"type":"PACKAGE","url":"https://github.com/KhronosGroup/NNEF-Tools"},{"type":"ARTICLE","url":"https://github.com/KhronosGroup/NNEF-Tools/blob/0bb9c04fcf69c19e0aefa1ba9bf65f05478c8f81/nnef-pyproject/nnef/__init__.py#L87"},{"type":"EVIDENCE","url":"https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/SJiYagajfe"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/khronosgroup/nnef-tools","events":[{"introduced":"0"},{"fixed":"bf4918401e23bc23f53f5e542b41a2f095342c22"},{"fixed":"8c249f62ac25ced13ad68962f409bb5e399f71d7"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.0.10"},{"fixed":"1.0.11"}],"source":"DESCRIPTION"}}],"versions":["nnef-v1.0.9","nnef_tools-v1.0.9","nnef_tools-v1.0.8","nnef-v1.0.8","nnef_tools-v1.0.7","nnef-v1.0.7","nnef_tools-v1.0.6","nnef-v1.0.6","nnef-v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110657.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}