Rembg: Arbitrary file disclosure and arbitrary ONNX computation (CVE-2026-115924)
Unauthenticated attackers can exploit a path traversal vulnerability in the Rembg /api/remove endpoint to download malicious ONNX files, leading to arbitrary ONNX computation and file disclosure.
CVE search metadata
CVE search record: CVE-2026-115924. Severity: high. CVSS: 8.6. KEV: no. Product: rembg (< 2.0.82). Brief: Rembg: Arbitrary file disclosure and arbitrary ONNX computation (CVE-2026-115924). Brief link: https://feed.craftedsignal.io/briefs/2026-10-rembg-path-traversal/
Triage facts
Revision 2- Applicability
- rembg (< 2.0.82)
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 2Oct 27, 17:58 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Revision history 1 entry · Revision 2
- Revision 2
poc_available
Changed: affected_products, affected_vendors, claim_state, cpes, has_poc, lastmod, references, updates
Sources: 1
Rembg versions prior to 2.0.82 contain a vulnerability in the /api/remove endpoint (CVE-2026-115924). The endpoint improperly processes the extras.sam_model parameter, passing it through rembg/commands/s_command.py to rembg/sessions/sam.py.
An attacker can supply a sam_model value combining path traversal and URL fragment syntax. This allows the attacker to force the application to download malicious ONNX encoder and decoder files into a local path. These files can then be used to load target files via ONNX external data, enabling the disclosure of file contents through the returned PNG mask and the execution of arbitrary ONNX computation.