0xiviel/

poc-openvino-onnx-path-traversal

	PoC: OpenVINO ONNX External Data Path Traversal (Arbitrary File Read)




	
	Summary

A malicious .onnx model can read arbitrary files from the filesystem via path traversal in the external_data location field. Confirmed on OpenVINO 2025.4.1 — reads /etc/passwd contents as tensor data.

ov::util::sanitize_path() at file_util.cpp:107 only strips leading /.\ characters. A path like x/../../../etc/passwd starts with x (not in strip set), so it passes through… See the full description on the dataset page: https://huggingface.co/datasets/0xiviel/poc-openvino-onnx-path-traversal.