Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-27489 is a high-severity Relative Path Traversal (CWE-23) vulnerability in Linuxfoundation Onnx. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as Machine Learning Libraries; in the Data-Related Vulnerabilities risk domain.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-27489 is a path traversal vulnerability affecting the Open Neural Network Exchange (ONNX), an open standard for machine learning model interoperability. In versions prior to 1.21.0, the vulnerability enables symlink-based path traversal, allowing attackers to read arbitrary files outside the intended model or user-provided directories. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWEs-23 (Path Traversal) and CWE-61 (Symlink Race Condition).
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity and no user interaction or privileges required. By crafting a malicious ONNX model containing symlinks, an attacker can traverse directory boundaries during model loading or processing, achieving high-impact unauthorized disclosure of sensitive files on the target system.
The vulnerability has been patched in ONNX version 1.21.0. The ONNX GitHub security advisory (GHSA-3r9x-f23j-gc73) and patching commit (4755f8053928dce18a61db8fec71b69c74f786cb) provide further details on the fix, recommending immediate upgrades for affected deployments.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17969
Vulnerability Data
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, a path traversal vulnerability via symlink allows to read arbitrary files outside model or user-provided directory. This issue has been patched in version…
more
1.21.0.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Machine Learning Libraries
- Risk Domain
- Data-Related Vulnerabilities
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: machine learning, neural network, onnx
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 2 OS baselines
V5.3.2V5.2.5
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement must resolve the actual target of any file reference and apply authorizations to it, directly stopping symlink traversal to unauthorized objects.
Explicit validation of path inputs stops .. sequences from ever being interpreted by the file system.
Information-flow rules can be configured to reject traversals that would move data outside an approved directory boundary.
Least privilege reduces the set of reachable files even when a traversal succeeds.
Secure-engineering principles require safe pathname construction and input neutralization before any file operation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that prevent relative traversal.
Vulnerability identification can discover existing symlink issues but does not prevent or remediate them in code.
Least-privilege access policies can limit damage from symlink attacks but do not address the coding flaw itself.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis, but does not itself implement the fix.
Secure development lifecycle mandates input validation and path-handling controls that directly prevent relative path traversal.
Application security requirements explicitly call for controls against path traversal and other injection flaws.
Secure architecture principles include directory isolation and canonicalization, reducing but not eliminating traversal risk.
Secure coding standards require neutralizing path traversal sequences, directly addressing CWE-23.
Information access restriction limits which files can be reached, mitigating impact but not preventing the traversal flaw.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248577 OL 8 must enable kernel parameters to enforce Discretionary Access Control (DAC) on symlinks. prevents CWE-61