CVE-2024-27318
Published: 23 February 2024
Summary
CVE-2024-27318 is a high-severity Path Traversal (CWE-22) vulnerability in Fedoraproject Fedora. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 38.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Deep Learning Frameworks; in the Data-Related Vulnerabilities risk domain; MITRE ATLAS techniques in scope: Physical Environment Access (AML.T0041), Verify Attack (AML.T0042), AML.T0026.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0124
Vulnerability details
Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory. The…
more
vulnerability occurs as a bypass for the patch added for CVE-2022-25882.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Deep Learning Frameworks
- Risk Domain
- Data-Related Vulnerabilities
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- ONNX (Open Neural Network Exchange) is a standard and library for representing and exchanging deep learning and machine learning models across frameworks like PyTorch and TensorFlow.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directory traversal in ONNX external_data field enables arbitrary local file reads outside intended directories, facilitating data collection from local system (T1005) and file/directory discovery (T1083).
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.