CVE-2025-51480: ONNX Path Traversal Vulnerability

CVE-2025-51480 Overview

CVE-2025-51480 is a path traversal vulnerability [CWE-22] in the Open Neural Network Exchange (ONNX) library version 1.17.0. The flaw resides in onnx.external_data_helper.save_external_data, which fails to validate external_data.location paths supplied within ONNX model files. Attackers can craft model files containing directory traversal sequences such as ../ to escape the intended output directory and overwrite arbitrary files on the host filesystem. Because ONNX is widely used to serialize and exchange machine learning models across frameworks like PyTorch, TensorFlow, and scikit-learn, this vulnerability affects machine learning pipelines, model registries, and inference services that load untrusted models.

Critical Impact
A remote attacker can overwrite arbitrary files on systems that load a malicious ONNX model, enabling code execution, configuration tampering, or persistence within machine learning infrastructure.

Affected Products

ONNX (Open Neural Network Exchange) version 1.17.0
Applications and ML pipelines that import untrusted ONNX models using the affected library
Model serving platforms that call save_external_data on attacker-supplied models

Discovery Timeline

2025-07-22 - CVE-2025-51480 published to the National Vulnerability Database
2025-10-08 - Last updated in NVD database

Technical Details for CVE-2025-51480

Vulnerability Analysis

The vulnerability stems from insufficient path sanitization in the save_external_data function inside onnx/external_data_helper.py. ONNX supports storing model tensor data in external files separate from the protobuf model definition. The external_data field of a TensorProto includes a location attribute that specifies the relative path where tensor data is written or read.

The affected function joins the user-supplied location value with the base directory without normalizing the resulting path or verifying it remains inside the intended directory. An attacker can supply location values containing traversal sequences such as ../../etc/cron.d/payload or absolute paths. When the application persists the model using save_external_data, these crafted paths cause writes outside the target directory.

The technical analysis from Gecko Security describes how a malicious ONNX file can target sensitive locations including SSH authorized keys, systemd unit files, or Python site-packages. See the Gecko Security advisory for CVE-2025-51480 for the full root-cause walkthrough.

Root Cause

The root cause is missing input validation [CWE-22] on a path component sourced from untrusted model data. The function trusts that external_data.location resolves to a safe path relative to the model directory. No checks reject traversal sequences, absolute paths, or symlink targets before the file write occurs.

Attack Vector

Exploitation requires a victim to load or save an attacker-controlled ONNX model. Attack vectors include public model hubs, supply-chain compromise of model repositories, and CI/CD pipelines that ingest models from external contributors. The attack requires user interaction in the form of opening the malicious model, but no authentication or special privileges on the target. Successful exploitation grants the attacker write primitive at the privilege level of the process loading the model, which is sufficient for code execution through file overwrite of executables, startup scripts, or interpreter modules.

The fix landed in ONNX Pull Request #6959 and follow-up hardening in ONNX Pull Request #7040.

Detection Methods for CVE-2025-51480

Indicators of Compromise

ONNX model files containing external_data.location values with ../, ..\, or absolute path prefixes such as /etc/ or C:\
Unexpected file writes outside model output directories during ONNX save or load operations
Process telemetry showing Python interpreters running ONNX workloads writing to sensitive paths such as ~/.ssh/, /etc/cron.d/, or site-packages directories
Newly modified system or startup files correlated in time with ONNX model ingestion events

Detection Strategies

Inspect ONNX models statically before loading and parse all TensorProto.external_data entries to flag any location value that contains traversal sequences or resolves outside the model directory
Monitor filesystem activity from Python processes hosting ONNX runtimes for writes outside designated model storage paths
Enumerate installed ONNX package versions across ML hosts and flag any system running version 1.17.0

Monitoring Recommendations

Log all model ingestion events in ML pipelines, including model source, hash, and parsed external_data paths
Alert on file modification events targeting system binaries, cron directories, SSH key files, or Python site-packages from data-science user accounts
Track outbound network calls from inference servers that may indicate post-exploitation activity following a successful file overwrite

How to Mitigate CVE-2025-51480

Immediate Actions Required

Upgrade ONNX to a version that includes the fixes from Pull Requests #6959 and #7040, which add path validation in save_external_data
Audit ML pipelines, model registries, and CI/CD systems for any code path that loads or saves ONNX models from untrusted sources
Restrict the filesystem permissions of processes that handle ONNX models to the minimum directories required for model storage
Validate all third-party ONNX models against a parser that rejects traversal sequences in external_data.location fields before loading

Patch Information

The ONNX maintainers addressed the path traversal in two upstream changes: Pull Request #6959 introduces path normalization and rejects locations outside the intended directory, and Pull Request #7040 extends the validation. Consult the GitHub Security Advisory GHSA-6rq9-53c3-f7vj for the authoritative fixed version list.

Workarounds

Run ONNX model loading inside a sandboxed container or chroot with a read-only root filesystem and a dedicated writable model directory
Pre-parse ONNX models with a custom validator that rejects any external_data.location containing .., leading /, or drive letters before passing the file to onnx APIs
Execute ONNX workloads under an unprivileged user account with no write access to system directories, SSH configuration, or shared Python environments

bash

# Configuration example: upgrade ONNX and verify installed version
pip install --upgrade onnx
python -c "import onnx; print(onnx.__version__)"