CVE-2026-115924

HighCVSS 8.6

Published: 26/10/2026(UTC)Updated: 31/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

34th percentile - higher than 34% of all known CVEs

Summary

Rembg prior to 2.0.82 passes attacker-controlled extras.sam_model into SAM filenames and GitHub download URLs without a pinned hash. An unauthenticated attacker can combine path traversal with URL fragment syntax to download malicious ONNX files beside a readable target file and disclose its contents in the returned PNG mask. The issue is fixed in version 2.0.82.

Risk Assessment

An attacker could read arbitrary files accessible to the rembg process and perform arbitrary ONNX computation, leading to data disclosure and potential code execution. The risk applies to the publicly reachable /api/remove endpoint.

Recommendation

Upgrade rembg to version 2.0.82 or later. Restrict access to the /api/remove endpoint and do not allow user-supplied sam_model values.

Other vulnerabilities in Rembg

CVE-2026-40086Medium
In rembg before 2.0.75, a path traversal vulnerability in the HTTP server allows unauthenticated remote attackers to read arbitrary files from the filesystem. By sending a crafted model_path parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially contents.

Original NVD description (English source)

Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sam_model through rembg/commands/s_command.py to rembg/sessions/sam.py, where it is interpolated into SAM filenames and GitHub download URLs passed to pooch.retrieve() without a pinned hash. An unauthenticated attacker can supply a sam_model value combining path traversal with URL fragment syntax to exploit the HTTP request discarding the fragment while the local POSIX path retains it. The first request primes the attacker-selected path tree, and an identical repeated request downloads malicious ONNX encoder and decoder files beside a readable target file. The graphs can load the target through ONNX external data and encode its bytes into the returned PNG mask, disclosing complete files accessible to the rembg process and allowing arbitrary ONNX computation. This issue is fixed in version 2.0.82.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS