Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in ONNX [CVE-2025-51480]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal, due to an issue with onnx.externaldatahelper.saveexternaldata in ONNX 1.17.0 that allows attackers to bypass intended directory restrictions. CVE-2025-51480. Onnx is used in our speech service runtimes. This...

a2 (>=0.10.7, <=0.10.13), aad2onnx (0.1.4) +1505 more potentially affected by CVE-2025-51480 via onnx (>=0.2.0, <=1.22.0)

onnx PYPI version =0.2.0, =0.10.7, =0.1.0.dev2, =6.6.0, =1.0.0, =0.1.0, =0.1.0, =0.1.4, =0.3.0, =0.4.4, =0.1.0, =0.4.0 - agentic-file-organizer 0.1.0 and more Source cves: CVE-2025-51480 Source advisory: SNYK:PYTHON-ONNX-10877916...

CVE-2025-51480

Path Traversal vulnerability in onnx.externaldatahelper.saveexternaldata in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted externaldata.location paths containing traversal sequences, bypassing intended directory restrictions...

CVE-2025-51480

Path Traversal vulnerability in onnx.externaldatahelper.saveexternaldata in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted externaldata.location paths containing traversal sequences, bypassing intended directory restrictions...

CVE-2025-51480

Path Traversal vulnerability in onnx.externaldatahelper.saveexternaldata in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted externaldata.location paths containing traversal sequences, bypassing intended directory restrictions...

CVE-2025-51480

A Path Traversal vulnerability exists in the onnx.external_data_helper.save_external_data function within ONNX 1.17.0 . Attackers can exploit this by supplying crafted external_data.location paths containing traversal sequences to overwrite arbitrary files , bypassing intended directory restricti...