CVE-2026-55832: 
Rust vulnerability analysis and mitigation

CVE-2026-55832 is a path traversal vulnerability in the tract-onnx Rust crate (part of the sonos/tract project) that allows arbitrary local file read when loading a malicious ONNX model. The vulnerability stems from the get_external_resources() function resolving ONNX tensor external-data location values without any sanitization, enabling attackers to craft a .onnx file that reads arbitrary files from the host filesystem. Affected versions are tract-onnx < 0.21.17, >= 0.22.0 and < 0.22.3, and >= 0.23.0 and < 0.23.2. It was published on June 18–19, 2026, with a CVSS v3.1 base score of 6.1 (Moderate) (GitHub Advisory, Sonos Advisory).

The root cause is CWE-22 (Path Traversal): in onnx/src/tensor.rs, the get_external_resources() function constructs a file path by calling PathBuf::from(path).join(location) where location is the attacker-controlled external_data field from the .onnx protobuf — with no checks for absolute paths, .. components, canonicalization, or containment within the model directory. Rust's Path::join discards the base directory when given an absolute path (e.g., /etc/passwd), and relative traversal sequences like ../../../../etc/shadow are not normalized. The MmapDataResolver in onnx/src/data_resolver.rs then memory-maps the resolved file and copies mmap[offset..offset+length] into the tensor, surfacing the file contents in inference output. Additionally, out-of-range offset/length values (also attacker-controlled) cause a panic, enabling denial of service. The vulnerability is reachable via the standard public API model_for_path() (GitHub Advisory, Sonos Advisory).

Successful exploitation results in read-only arbitrary local file disclosure: any file readable by the process running tract (e.g., /etc/passwd, SSH private keys, application secrets, environment files) can be exfiltrated via the model's tensor/inference output. There is no write capability or code execution, and integrity is not affected. A secondary impact is denial of service via panic when out-of-bounds offset/length values are specified in the malicious model. The attack is particularly relevant in scenarios where applications load untrusted ONNX models from model hubs, multi-file repositories, or user uploads (GitHub Advisory).

A public proof-of-concept (PoC) is included in the advisory itself, tested against tract-onnx 0.21.16 on Rust 1.96, demonstrating successful exfiltration of a canary file via a crafted evil.onnx. Exploitation requires user interaction in the sense that a victim application must load the malicious model file, but no privileges are required. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the CVE status remains "Reserved" as of the advisory date. The vulnerability is not listed in the CISA KEV catalog, and no EPSS score is currently published (GitHub Advisory, Sonos Advisory).

1. Craft a malicious ONNX model: Using Python and the onnx library, create an evil.onnx file with a UINT8 tensor initializer whose external_data field sets location to an absolute path (e.g., /etc/passwd) or a relative traversal path (e.g., ../../../../etc/shadow), with offset=0 and length=<desired byte count>.
2. Embed the payload: Serialize the model with a graph that passes the external-data tensor through an Identity node to the output, ensuring the file contents flow into the inference result.
3. Deliver the model: Distribute the malicious .onnx file to a target application — via a model hub, shared repository, user upload endpoint, or any channel where the application loads external ONNX models.
4. Trigger model loading: The victim application calls tract_onnx::onnx().model_for_path("evil.onnx"), which invokes get_external_resources() and resolves the attacker-controlled location to the target file without sanitization.
5. Extract file contents: Run inference (into_optimized()?.into_runnable()?.run(tvec!())?) and read the output tensor bytes, which contain the contents of the targeted local file (GitHub Advisory, Sonos Advisory).

• File System: Presence of unexpected .onnx files in application directories, especially those with unusually small sizes or no accompanying weight data files; .onnx files referencing absolute paths or .. sequences in their protobuf external_data.location fields (inspectable with protoc or the onnx Python library).
• Logs: Application logs showing model_for_path() calls loading .onnx files from untrusted or external sources; unexpected file open/mmap operations on sensitive files (e.g., /etc/passwd, ~/.ssh/id_rsa) by the application process, visible in strace or auditd logs.
• Process: Unusual file descriptor activity from the tract-based application process accessing files outside the model directory, detectable via lsof or Linux audit rules on sensitive paths.

Upgrade tract-onnx to one of the patched versions: 0.21.17, 0.22.3, or 0.23.2, depending on the release branch in use. The advisory recommends that the fix reject absolute location values and any .. path components, canonicalize the resolved path, verify it remains within the model directory (mirroring the approach taken in onnx 1.22.0's resolve_external_data_location), reject symlinks, and validate offset/length against the actual file size before slicing. As a workaround prior to patching, avoid loading ONNX models from untrusted sources, and consider sandboxing the tract process with restricted filesystem access (e.g., using seccomp, namespaces, or chroot) to limit the files accessible to the process (GitHub Advisory, Sonos Advisory).