CVE-2026-55832: Tract ONNX Path Traversal Vulnerability

CVE-2026-55832 Overview

CVE-2026-55832 is a path traversal vulnerability [CWE-22] in the tract-onnx crate, part of the Sonos Tract TensorFlow and ONNX inference toolkit written in Rust. The flaw resides in onnx/src/tensor.rsget_external_resources, which joins the attacker-controlled external_data location from an ONNX model to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path causes onnx/src/data_resolver.rsMmapDataResolver to open an arbitrary local file and place its contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice, causing a denial of service. Versions prior to 0.21.17, 0.22.3, and 0.23.2 are affected.

Critical Impact
A malicious ONNX model can force Tract to read arbitrary local files and expose their contents through inference output, leading to sensitive information disclosure on the host running the inference toolkit.

Affected Products

Sonos Tract tract-onnx crate versions prior to 0.21.17
Sonos Tract tract-onnx crate versions prior to 0.22.3
Sonos Tract tract-onnx crate versions prior to 0.23.2

Discovery Timeline

2026-09-14 - CVE-2026-55832 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-55832

Vulnerability Analysis

Tract is a self-contained inference toolkit that loads ONNX models and executes them on the host. ONNX models support an external_data mechanism where tensor weights live in separate files referenced by a location string. Tract passes this attacker-controlled string directly into path joining logic without validation.

Because the joined path is opened via File::open, an absolute path replaces the model directory entirely, and .. components traverse outside it. The mapped file bytes are then written into tensors that appear in inference output, giving the attacker read access to any file the Tract process can access. Attacker-supplied offset and length values also bypass bounds checks against the file size, enabling denial of service through invalid memory-mapped slices.

Root Cause

The root cause is missing sanitization of the location field parsed from the untrusted ONNX model in onnx/src/tensor.rs. The code accepts absolute paths and .. components, and onnx/src/data_resolver.rs does not verify that offset and length fall within the target file size before mapping.

Attack Vector

Exploitation requires a local user to load a malicious ONNX model through model_for_path. The attack does not write files or execute code, but any file readable by the Tract process can be exfiltrated through inference output. The vulnerability requires user interaction to load the crafted model.

rust

// Patch in onnx/src/tensor.rs - Reject absolute paths and parent directory components
        .map(|it| it.value.as_str())
        .context("Could not find external data location")?;

+    // `location` comes from the untrusted model file; confine it to the model
+    // directory so it cannot escape via an absolute path or `..`.
+    let location_path = std::path::Path::new(location);
+    if location_path
+        .components()
+        .any(|c| !matches!(c, std::path::Component::Normal(_) | std::path::Component::CurDir))
+    {
+        bail!(
+            "external data location must be a relative path inside the model directory, got {location:?}"
+        );
+    }
+
    let offset: usize = t
        .external_data
        .iter()
// Source: https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f

rust

// Patch in onnx/src/data_resolver.rs - Bound offset and length against file size
    ) -> TractResult<()> {
        let file = File::open(p).with_context(|| format!("Opening {p:?}"))?;
        let file_size = file.metadata()?.len() as usize;
+        ensure!(
+            offset <= file_size,
+            "external data offset {offset} is past end of file ({file_size} bytes)"
+        );
        let length = length.unwrap_or(file_size - offset);
+        ensure!(
+            length <= file_size - offset,
+            "external data length {length} from offset {offset} exceeds file size {file_size}"
+        );
        buf.reserve(length);

        let mut reader = BufReader::new(file);
// Source: https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f

Detection Methods for CVE-2026-55832

Indicators of Compromise

ONNX model files containing external_data entries with location values that begin with /, a drive letter, or contain .. path segments.
Tract processes opening files outside the expected model directory, such as /etc/passwd, SSH keys, or configuration files under user home directories.
Unexpected error messages from Tract referencing failed file opens on system paths during model loading.

Detection Strategies

Statically scan ONNX model repositories and pipelines for TensorProto entries whose external_datalocation field contains absolute paths or parent directory traversal.
Instrument the Tract host with file access auditing (auditd on Linux, ETW on Windows) filtered to the inference process, and alert on reads outside the model directory.
Review the version of the tract-onnx crate in dependency manifests (Cargo.toml, Cargo.lock) against fixed releases 0.21.17, 0.22.3, and 0.23.2.

Monitoring Recommendations

Monitor process telemetry for Tract-based inference services opening file handles to paths outside the designated model directory.
Log ingestion and provenance metadata for every ONNX model loaded in production, including source, hash, and signing status.
Alert on crashes or abnormal termination of Tract processes shortly after model load, which may indicate exploitation of the out-of-range offset and length flaw.

How to Mitigate CVE-2026-55832

Immediate Actions Required

Upgrade the tract-onnx crate to version 0.21.17, 0.22.3, or 0.23.2 depending on the release branch in use.
Treat every ONNX model from an untrusted source as hostile input and validate it before loading through model_for_path.
Run Tract-based inference services under a dedicated low-privilege account with filesystem access restricted to the model directory.

Patch Information

Sonos fixed the issue in Tract release 0.21.17, Tract release 0.22.3, and Tract release 0.23.2. The fix commits 5f994bc, 85f4fac, and 8fdacbd reject absolute paths and .. in external_data locations and bound the offset and length against the file size. See the GHSA-h668-6x6g-f8r5 advisory for full details.

Workarounds

Pre-scan ONNX model files and reject any whose TensorProto.external_datalocation field is not a relative path within the model directory.
Load models inside a sandbox (container, namespace, or seccomp profile) that exposes only the model directory to the Tract process.
Require cryptographic signatures on model artifacts and refuse to load models that do not originate from a trusted publisher.

bash

# Update the tract-onnx dependency to a fixed version
cargo update -p tract-onnx --precise 0.21.17
# or, for the 0.22.x branch
cargo update -p tract-onnx --precise 0.22.3
# or, for the 0.23.x branch
cargo update -p tract-onnx --precise 0.23.2

# Verify the resolved version
cargo tree -p tract-onnx