CVE-2024-27318

Name of the Vulnerable Software and Affected Versions onnx versions prior to 1.15.0

Description The issue allows Directory Traversal as the external data field of the tensor proto can have a path to a file outside the model's current directory or user-provided directory. This vulnerability occurs as a bypass for a previously added patch.

Recommendations For versions prior to 1.15.0, update to a version later than 1.15.0 to resolve the issue. As a temporary workaround, consider restricting access to the external data field of the tensor proto to minimize the risk of exploitation.