HDF5 external raw storage file read is an arbitrary-file-read bug that abuses a legitimate HDF5 feature: a dataset's raw bytes can be stored in an external file referenced by path. An attacker crafts an .h5 or .hdf5 file whose dataset points at a local path such as /etc/passwd or a traversal path. When a victim application opens the file and reads the dataset, the HDF5 library reads that external file and hands back its contents. It matters most for ML pipelines that load untrusted HDF5 models or datasets. The fix is to reject or restrict external storage on untrusted files.
What HDF5 external storage file read is
HDF5 is a binary container format (.h5 and .hdf5) used for scientific data and for machine learning models, including Keras. It supports external storage, where a dataset does not hold its raw bytes inside the container but in a separate file on disk, referenced by a path stored in the dataset's creation properties. That reference is data inside the file, so whoever creates the file controls the path. If an application parses an attacker-supplied HDF5 file and reads such a dataset, it reads whatever local file the path points to.
How it works and example
The attacker builds an HDF5 file with a dataset configured for external storage (the H5Pset_external property, exposed in h5py as Dataset.external) whose path is an absolute path like /etc/passwd or a traversal path such as ../../../../etc/passwd. They send that file to any surface that parses HDF5: a model upload, a dataset import, a conversion API. When the app reads the dataset, for example f['data'][:] in h5py or a model load, the HDF5 library opens the referenced local file and returns its bytes through whatever exposes the dataset, an API response, an error message, or model weights. This is a file read, not code execution, but it leaks secrets, source, keys, and configuration. Examples are shown for defensive testing.
How to fix it
Treat every uploaded or third-party HDF5 file as untrusted. Before reading datasets, inspect the dataset creation properties and reject any file that uses external storage (in h5py, check Dataset.external or the property list's external count and refuse it). Restrict the library's file-access prefix so external paths cannot escape a safe directory, and parse untrusted files in a sandbox with no access to sensitive files. Do not echo dataset contents back to the requester. For machine learning specifically, avoid loading untrusted model files at all, and prefer formats such as safetensors over HDF5 or pickle for models from unknown sources.
References
- [1]OWASP Web Security Testing Guide(OWASP)
- [2]MITRE CWE-610: Externally Controlled Reference to a Resource(MITRE CWE)
- [3]HDF5 external storage (H5Pset_external)(HDF Group)
- [4]MITRE CWE-73: External Control of File Name or Path(MITRE CWE)
If your app or ML pipeline parses HDF5 files from users, external storage file read is in scope. Talk to a security expert about testing your parsing paths.