# CVE-2024-5187: ONNX path traversal in download_model_with_test_data

Source: https://junglewise.ai/threats/cve-2024-5187-onnx-path-traversal-in-download-model-with-test-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-06-06. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2024-5187 · Severity: high · CVSS 8.8 · Published 2024-06-06

ONNX is an open-source format for artificial intelligence models. A security flaw in its model download utility allows a malicious model file to overwrite critical system files when it is downloaded and extracted. This could allow an attacker to gain unauthorized access to the system, delete important data, or disrupt operations.

Technologies: [onnx (PyPI)](https://junglewise.ai/threats/technologies/onnx). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-5187 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-5187 being exploited in the wild.

**How severe is CVE-2024-5187?** High severity, with a CVSS score of 8.8, published 6 June 2024.

**Which products and versions are affected?** onnx (PyPI) < 1.16.2, ECOSYSTEM:introduced=0,fixed=1.16.2, ECOSYSTEM:introduced=0,last_affected=1.17.0.

**Is there a fix for CVE-2024-5187?** Yes. onnx (PyPI): upgrade to 1.16.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-5187 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-5187?** Check whether you run onnx (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- onnx (PyPI): upgrade to 1.16.2 or later

  ```sh
  pip install "onnx>=1.16.2"
  ```


## Technical details

A path traversal vulnerability (CWE-22) exists in the `download_model_with_test_data` function of the ONNX framework. The root cause is the lack of validation for file paths contained within tar archives during extraction. An attacker can craft a malicious tar file containing absolute paths or parent directory references (e.g., `../../`) to overwrite arbitrary files on the host system. This can be leveraged for remote code execution (e.g., by overwriting `.ssh/authorized_keys`) or denial of service. Exploitation requires a user to download a malicious model using the affected function. The issue is resolved in version 1.16.2.

## Affected products

- onnx onnx < 1.16.2

## Identifiers

- CVE-2024-5187
- GHSA-6rq9-53c3-f7vj
- PYSEC-2025-148

## Timeline

- 2024-06-06: disclosed
- 2024-06-06: advisory
- 2024-06-06: patched: Version 1.16.2 released

## References

- [https://api.github.com/users/stevegrubb](https://api.github.com/users/stevegrubb)
- [https://github.com/stevegrubb](https://github.com/stevegrubb)
- [https://api.github.com/users/stevegrubb/gists%7B/gist_id%7D](https://api.github.com/users/stevegrubb/gists%7B/gist_id%7D)
- [https://api.github.com/users/stevegrubb/repos](https://api.github.com/users/stevegrubb/repos)
- [https://avatars.githubusercontent.com/u/18726848?v=4](https://avatars.githubusercontent.com/u/18726848?v=4)
- [https://api.github.com/users/stevegrubb/events%7B/privacy%7D](https://api.github.com/users/stevegrubb/events%7B/privacy%7D)

## Related threats

- [ONNX memory exhaustion in packed tensor unpacking](https://junglewise.ai/threats/cve-2026-115922-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX null pointer dereference in shape inference](https://junglewise.ai/threats/cve-2026-115921-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX ConvTranspose shape inference denial of service](https://junglewise.ai/threats/cve-2026-115920-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX out-of-bounds read in RNN shape inference](https://junglewise.ai/threats/cve-2026-115919-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX TOCTOU race condition in save_external_data](https://junglewise.ai/threats/onnx-toctou-race-condition-in-save-external-data-b85422b8)