CVE-2026-55832
Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx
Description
Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.
INFO
Published Date :
Sept. 14, 2026, 6:17 p.m.
Last Modified :
Sept. 14, 2026, 7:17 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update tract-onnx to version 0.21.17 or later.
- Update tract-onnx to version 0.22.3 or later.
- Update tract-onnx to version 0.23.2 or later.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-55832.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-55832 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-55832
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-55832 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-55832 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Sep. 14, 2026
Action Type Old Value New Value Added Reference https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5 Added SSVC {'id': 'CVE-2026-55832', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-09-14T18:12:49.766808Z'} -
New CVE Received by [email protected]
Sep. 14, 2026
Action Type Old Value New Value Added Description Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2. Added CVSS V3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L Added CWE CWE-22 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/55xxx/CVE-2026-55832.json">CVE-2026-55832</a> Added Reference https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f Added Reference https://github.com/sonos/tract/commit/85f4fac23e43d417782e8ed9f9465be8474f5c98 Added Reference https://github.com/sonos/tract/commit/8fdacbd7abe4e6f929cadfe52e7f69e2227c0632 Added Reference https://github.com/sonos/tract/releases/tag/0.21.17 Added Reference https://github.com/sonos/tract/releases/tag/0.22.3 Added Reference https://github.com/sonos/tract/releases/tag/v0.23.2 Added Reference https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5