CVE-2026-115924
Received Received - Intake

Path Traversal in Rembg Leading to File Disclosure

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: GitHub, Inc.

Description
Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sam_model through rembg/commands/s_command.py to rembg/sessions/sam.py, where it is interpolated into SAM filenames and GitHub download URLs passed to pooch.retrieve() without a pinned hash. An unauthenticated attacker can supply a sam_model value combining path traversal with URL fragment syntax to exploit the HTTP request discarding the fragment while the local POSIX path retains it. The first request primes the attacker-selected path tree, and an identical repeated request downloads malicious ONNX encoder and decoder files beside a readable target file. The graphs can load the target through ONNX external data and encode its bytes into the returned PNG mask, disclosing complete files accessible to the rembg process and allowing arbitrary ONNX computation. This issue is fixed in version 2.0.82.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-115924
EUVD
EUVD-2026-110073

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
danielgatis rembg < 2.0.82

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal flaw in the Rembg tool's /api/remove endpoint. It allows unauthenticated attackers to manipulate the extras.sam_model parameter to inject malicious paths and URL fragments. The attacker can then place harmful ONNX model files next to target files, which read those files as external data and encode their contents into a returned PNG image, leading to complete file disclosure within the filesystem permissions of the rembg process.

Detection Guidance

Check if your rembg instance is running version 2.0.81 or earlier. Inspect network logs for requests to /api/remove with unusual sam_model parameters containing path traversal or URL fragments. Look for unexpected ONNX model files in cache directories or alongside target files.

Impact Analysis

An attacker could exploit this to read sensitive files accessible to the rembg process, such as configuration files, credentials, or system files like /etc/passwd. If the rembg container runs as root, highly sensitive files could be exposed. The attacker could also perform arbitrary ONNX computations through malicious model files.

Compliance Impact

This vulnerability could lead to unauthorized access and disclosure of personal or sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade rembg to version 2.0.82 or later. Ensure the SAM_MODELS allowlist is enforced and MD5 checksums are validated. Restrict the rembg process to non-root privileges and use a read-only filesystem. Validate all sam_model inputs server-side to reject path traversal and URL fragments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115924. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart