You can deploy this model and start earning money today!

htdy7703/
openvino-ir-bin-symlink-read-poc-20260716

Name: openvino-ir-bin-symlink-read-poc-20260716
Availability: InStock

Views

No views yet

OpenVINO IR `model.bin` symlink file-read PoC

This repository demonstrates a verified OpenVINO issue where ov.Core().read_model("model.xml") implicitly opens a sibling model.bin path and follows a symlink outside the model directory.

The PoC script creates:

a minimal OpenVINO IR model.xml whose output is a single Const
a symlinked model.bin pointing at an attacker-chosen local file

When the model is loaded and compiled, the constant output exposes bytes from the symlink target through normal inference output.

Verified product:

openvino 2026.2.1-21919-ede283a88e3-releases/2026/2

Quick run:

python reproduce.py /etc/passwd --size 16

Expected proof:

b'root:x:0:0:root:'

The issue is local file disclosure, not code execution.

htdy7703/openvino-ir-bin-symlink-read-poc-20260716

OpenVINO IR model.bin symlink file-read PoC

htdy7703/
openvino-ir-bin-symlink-read-poc-20260716

OpenVINO IR `model.bin` symlink file-read PoC