CVE-2022-25882: Linuxfoundation Onnx

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory, for example "../../../etc/passwd"

Affected products

• Linuxfoundation Onnx: before 1.13.0 (fixed in 1.13.0)

Published 2023-01-26. Last modified 2026-06-17.