{"id":"CVE-2026-49114","summary":"ONNX symlink-following and path-traversal arbitrary file write","details":"In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.","aliases":["GHSA-q56x-g2fj-4rj6"],"modified":"2026-08-23T03:53:39.798435206Z","published":"2026-08-21T16:10:56.241Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49114.json","cna_assigner":"cisa-cg","cwe_ids":["CWE-22","CWE-367","CWE-59"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49114.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49114"},{"type":"ADVISORY","url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-233-01.json"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-49114"},{"type":"EVIDENCE","url":"https://github.com/onnx/onnx/security/advisories/GHSA-q56x-g2fj-4rj6"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/onnx/onnx","events":[{"introduced":"0"},{"fixed":"be2b5fde82d9c8874f3d19328bdfe3b6962dc67b"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.21.0"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v1.3.0","v1.1.0","v0.2","v0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49114.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}]}