You can deploy this model and start earning money today!

tonydav41/
tf-savedmodel-poc-asset-traversal-2026-05-12

Name: tf-savedmodel-poc-asset-traversal-2026-05-12
Availability: InStock

tf-keras

Views

No views yet

TensorFlow SavedModel Path Traversal PoC

Bug

AssetFileDef.filename in TensorFlow SavedModel (tested on TF 2.21.0) is joined to the model's assets/ directory via io::JoinPath / file_io.join with NO traversal containment check. The joined path becomes loaded.asset.asset_path, which is read by user code and passed as a graph input to init_op/restore_op execution.

Files

mal_model/ — Malicious SavedModel (saved_model.pb + variables/ + assets/) crafted to traverse out of its assets dir
build_poc.py — Builds the malicious SavedModel and demonstrates the traversal
repro.sh — One-command reproducer (sets up venv, runs build_poc.py, asserts sentinel)
legit.txt — A "legitimate" asset reference for comparison

Reproduce

bash repro.sh

Expected: /tmp/TF_PWN_ASSET_TRAVERSAL.txt is created (the PoC also reads /tmp/SECRET_OUTSIDE_MODEL.txt via loaded.asset.asset_path).

Affected files in TF source

tensorflow/python/saved_model/loader_impl.py:162-164
tensorflow/cc/saved_model/loader.cc:158-164
tensorflow/core/grappler/grappler_item_builder.cc:499-508
tensorflow/compiler/mlir/tensorflow/translate/import_model.cc:1230-1233
tensorflow/compiler/mlir/quantization/tensorflow/cc/convert_asset_args.cc:63-80
tensorflow/python/saved_model/builder_impl.py:766-770

Distinguisher from prior CVEs

CVE-2022-23578 — tensor_info, not filename
CVE-2022-29191 — variables/index path
CVE-2021-37671 — saved_model_cli eval

This is a fresh primitive on a different field of the SavedModel format.

Severity

CVSS 3.1 7.1 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). ML-multiplier eligible: training-data exfiltration + weight tampering + inference-time SSRF via gfile-schemed paths.

Reporter

Tony Davis (lendtrain on huntr) — 2026-05-12.

tonydav41/tf-savedmodel-poc-asset-traversal-2026-05-12