CVE-2024-5187

CVE-2024-5187 is a critical path traversal vulnerability in the onnx/onnx framework, specifically affecting version 1.16.0, which allows for arbitrary file overwrite. Attackers can exploit this by crafting malicious tar files that, when processed by the download_model_with_test_data function, can overwrite any file on the system, including sensitive files like authorized_keys. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk of remote code execution, data deletion, and significant impact on system integrity and availability, requiring user interaction for exploitation. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.