Skip to content
Fencer Intel
high 7.1

CVE-2026-49114 json

ONNX symlink-following and path-traversal arbitrary file write

published 7mo ago modified 27d ago also EUVD-2026-63995 , GHSA-q56x-g2fj-4rj6 , PYSEC-2026-3876

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits
0
none known

Summary

In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, cron files, or application configs. Fixed in 1.21.0.

Patch / fix

  • pypi onnx 1.21.0
  • ONNX ONNX 1.21.0

Is CVE-2026-49114 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-49114 updated cvss 7.3

onnx: ONNX: Arbitrary file write via symlink following and path traversal

  • Red Hat OpenShift AI 2.25 rhoai/odh-openvino-model-server-rhel9 1791275700
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.4 rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 1791829182, rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 1791868244, rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 1791829615, rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 1791868194, rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 1791829530, rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 1791829804, +8 more
    fixed: vendor fix RHSA-2026:84734
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlserver-rhel9, rhoai/odh-mlserver-cuda-rhel9 Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1792570619, rhoai/odh-vllm-cpu-rhel9 1792018436, rhoai/odh-dashboard-rhel9 1791853525, rhoai/odh-modelmesh-rhel9 1790881700, rhoai/odh-operator-bundle 1792571069, rhoai/odh-vllm-cuda-rhel9 1791358976, +65 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1791509689, rhoai/odh-automl-rhel9 1791535789, rhoai/odh-mlflow-rhel9 1791865967, rhoai/odh-autorag-rhel9 1791557539, rhoai/odh-trainer-rhel9 1791869783, +86 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa vex VA-26-233-01 updated cvss 7.1

ONNX symlink-following and path-traversal arbitrary file write

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2mo ago

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-11).

Exploits and checks

  • github.com https://github.com/onnx/onnx/security/advisories/GHSA-q56x-g2fj-4rj6 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CNA 4.0 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
GitHub 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CNA 4.0 6.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
OSV 3.1 7.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi onnx
<1.21.0
1.21.0

Affected products

  • ONNX ONNX

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of onnx/onnx published their own advisory on GitHub. Reviewed sources take precedence over it.