{"id":"CVE-2026-55832","summary":"Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx","details":"Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.","aliases":["GHSA-h668-6x6g-f8r5"],"modified":"2026-09-16T03:47:01.768689429Z","published":"2026-09-14T17:57:41.374Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55832.json"},"references":[{"type":"WEB","url":"https://github.com/sonos/tract/releases/tag/0.21.17"},{"type":"WEB","url":"https://github.com/sonos/tract/releases/tag/0.22.3"},{"type":"WEB","url":"https://github.com/sonos/tract/releases/tag/v0.23.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55832.json"},{"type":"ADVISORY","url":"https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55832"},{"type":"FIX","url":"https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f"},{"type":"FIX","url":"https://github.com/sonos/tract/commit/85f4fac23e43d417782e8ed9f9465be8474f5c98"},{"type":"FIX","url":"https://github.com/sonos/tract/commit/8fdacbd7abe4e6f929cadfe52e7f69e2227c0632"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sonos/tract","events":[{"introduced":"0"},{"introduced":"2f8f99bc6c22ec44eba810eea49ca9602255408f"},{"introduced":"bf90b4b9ef4099a25217ec0aef3d5b9aa0497e38"},{"fixed":"b0c1bc8e8073bfa29b53460ac4210869863b84e3"},{"fixed":"1541d4037cd9960107385079f1732968daacafd5"},{"fixed":"d80f31682f47a92e8f5f90512201f26c9d9bdc7a"},{"fixed":"5f994bcf3cec9b343830a975fedce177f9190d0f"},{"fixed":"85f4fac23e43d417782e8ed9f9465be8474f5c98"},{"fixed":"8fdacbd7abe4e6f929cadfe52e7f69e2227c0632"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.21.17"},{"introduced":"0.22.0"},{"fixed":"0.22.3"},{"introduced":"0.23.0"},{"fixed":"0.23.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v0.21.16","0.21.16","v0.22.2","0.22.2","v0.22.1","0.22.1","v0.23.1","v0.23.0","v0.21.15","0.21.15","v0.21.14","0.21.14","v0.21.branching","0.21.branching","v0.22.0","0.22.0","v0.21.13","0.21.13","v0.21.12","0.21.12","v0.21.11","0.21.11","v0.21.10","0.21.10","v0.21.9","0.21.9","v0.21.8","0.21.8","v0.21.7","0.21.7","v0.21.6","0.21.6","v0.21.5","0.21.5","v0.21.4","0.21.4","v0.21.3","0.21.3","v0.21.2","0.21.2","v0.21.1","0.21.1","v0.21.0","0.21.0","v0.20.22","0.20.22","v0.20.21","0.20.21","v0.20.20","0.20.20","v0.20.19","0.20.19","v0.20.18","0.20.18","v0.20.6","0.20.6","v0.20.5","0.20.5","v0.20.4","0.20.4","v0.20.3","0.20.3","v0.20.2","0.20.2","v0.19.2","0.19.2","v0.19.1","0.19.1","v0.19.0","0.19.0","v0.19.0-alpha.19","0.19.0-alpha.19","v0.19.0-alpha.18","0.19.0-alpha.18","v0.19.0-alpha.17","0.19.0-alpha.17","v0.19.0-alpha.8","0.19.0-alpha.8","v0.18.3","0.18.3","v0.18.2","0.18.2","v0.18.1","0.18.1","v0.18.0","0.18.0","v0.17.7","0.17.7","v0.17.4","0.17.4","v0.17.3","0.17.3","v0.17.2","0.17.2","v0.17.1","0.17.1","v0.17.0","0.17.0","v0.16.9","0.16.9","v0.16.8","0.16.8","v0.16.7","0.16.7","v0.16.6","0.16.6","v0.16.5","0.16.5","v0.16.4","0.16.4","v0.16.3","0.16.3","v0.16.1","0.16.1","v0.16.0","0.16.0","v0.15.8","0.15.8","v0.15.7","0.15.7","v0.15.5","0.15.5","v0.15.4","0.15.4","v0.15.3","v0.15.2","0.15.2","v0.15.1","0.15.1","v0.15.0","0.15.0","v0.14.2","0.14.2","v0.14.1","0.14.1","v0.14.0","0.14.0","v0.13.2","0.13.2","v0.13.1","0.13.1","v0.13.0","0.13.0","v0.12.5","0.12.5","v0.12.4","0.12.4","v0.12.2","0.12.2","v0.12.1","0.12.1","v0.11.2","0.11.2","v0.11.1","0.11.1","v0.11.0","0.11.0","v0.10.10","0.10.10","v0.10.9","0.10.9","v0.10.8","0.10.8","v0.10.7","0.10.7","v0.10.6","0.10.6","0.10.5","cli/0.10.4","kaldi/0.10.4","onnx/0.10.4","tensorflow/0.10.4","hir/0.10.4","nnef/0.10.4","core/0.10.4","linalg/0.10.4","cli/0.10.3","kaldi/0.10.3","tensorflow/0.10.3","hir/0.10.3","core/0.10.3","linalg/0.10.3","cli/0.10.0","kaldi/0.10.0","onnx/0.10.0","tensorflow/0.10.0","hir/0.10.0","core/0.10.0","linalg/0.10.0","cli/0.9.2","kaldi/0.9.2","onnx/0.9.2","tensorflow/0.9.2","hir/0.9.2","core/0.9.2","linalg/0.9.2","cli/0.9.1","kaldi/0.9.1","onnx/0.9.1","tensorflow/0.9.1","hir/0.9.1","core/0.9.1","linalg/0.9.1","cli/0.9.0","kaldi/0.9.0","onnx/0.9.0","tensorflow/0.9.0","hir/0.9.0","core/0.9.0","linalg/0.9.0","cli/0.8.0","kaldi/0.8.0","onnx/0.8.0","tensorflow/0.8.0","hir/0.8.0","linalg/0.8.0","cli/0.7.0","onnx/0.7.0","kaldi/0.7.0","tensorflow/0.7.0","hir/0.7.0","linalg/0.7.0","cli/0.6.3","kaldi/0.6.3","onnx/0.6.3","tensorflow/0.6.3","hir/0.6.3","core/0.6.3","linalg/0.6.3","cli/0.6.2","kaldi/0.6.2","onnx/0.6.2","tensorflow/0.6.2","hir/0.6.2","core/0.6.2","linalg/0.6.2","cli/0.6.1","kaldi/0.6.1","onnx/0.6.1","tensorflow/0.6.1","hir/0.6.1","core/0.6.1","linalg/0.6.1","cli/0.6.0","kaldi/0.6.0","onnx/0.6.0","tensorflow/0.6.0","hir/0.6.0","core/0.6.0","linalg/0.6.0","cli/0.5.11","kaldi/0.5.11","onnx/0.5.11","tensorflow/0.5.11","core/0.5.11","linalg/0.5.11","cli/0.5.10","onnx/0.5.10","kaldi/0.5.10","tensorflow/0.5.10","core/0.5.10","linalg/0.5.10","cli/0.5.9","kaldi/0.5.9","onnx/0.5.9","tensorflow/0.5.9","core/0.5.9","linalg/0.5.9","cli/0.5.8","kaldi/0.5.8","onnx/0.5.8","tensorflow/0.5.8","core/0.5.8","linalg/0.5.8","cli/0.5.7","kaldi/0.5.7","onnx/0.5.7","tensorflow/0.5.7","core/0.5.7","linalg/0.5.7","cli/0.5.6","kaldi/0.5.6","onnx/0.5.6","tensorflow/0.5.6","core/0.5.6","linalg/0.5.6","cli/0.5.5","kaldi/0.5.5","onnx/0.5.5","tensorflow/0.5.5","core/0.5.5","linalg/0.5.5","cli/0.5.4","kaldi/0.5.4","onnx/0.5.4","tensorflow/0.5.4","core/0.5.4","linalg/0.5.4","cli/0.5.3","kaldi/0.5.3","onnx/0.5.3","tensorflow/0.5.3","core/0.5.3","linalg/0.5.3","cli/0.5.1","kaldi/0.5.1","onnx/0.5.1","tensorflow/0.5.1","core/0.5.1","linalg/0.5.1","cli/0.5.0","kaldi/0.5.0","onnx/0.5.0","tensorflow/0.5.0","core/0.5.0","linalg/0.5.0","cli/0.4.2","kaldi/0.4.2","onnx/0.4.2","tensorflow/0.4.2","core/0.4.2","linalg/0.4.2","cli/0.4.1","kaldi/0.4.1","onnx/0.4.1","tensorflow/0.4.1","core/0.4.1","linalg/0.4.1","cli/0.4.0","kaldi/0.4.0","onnx/0.4.0","tensorflow/0.4.0","core/0.4.0","linalg/0.4.0","cli/0.3.3","onnx/0.3.3","tensorflow/0.3.3","core/0.3.3","linalg/0.3.3","cli/0.3.2","onnx/0.3.2","tensorflow/0.3.2","core/0.3.2","linalg/0.3.2","cli/0.3.1","onnx/0.3.1","tensorflow/0.3.1","core/0.3.1","linalg/0.3.1","cli/0.3.0","tensorflow/0.3.0","onnx/0.3.0","core/0.3.0","linalg/0.3.0","cli/0.2.8","onnx/0.2.8","tensorflow/0.2.8","core/0.2.8","linalg/0.2.8","cli/0.2.7","onnx/0.2.7","tensorflow/0.2.7","core/0.2.7","linalg/0.2.7","cli/0.2.5","onnx/0.2.5","tensorflow/0.2.5","core/0.2.5","linalg/0.2.5","cli/0.2.4","onnx/0.2.4","tensorflow/0.2.4","core/0.2.4","linalg/0.2.4","cli/0.2.2","onnx/0.2.2","tensorflow/0.2.2","core/0.2.2","linalg/0.2.2","cli/0.2.1","onnx/0.2.1","tensorflow/0.2.1","core/0.2.1","linalg/0.2.1","cli/0.2.0","tensorflow/0.2.0","onnx/0.2.0","core/0.2.0","linalg/0.2.0","cli/0.1.1","onnx/0.1.1","tensorflow/0.1.1","core/0.1.1","0.0.10","0.0.9","0.0.8","0.0.7","0.0.6","0.0.5","0.0.4","0.0.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55832.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L"}]}