{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/rembg--2.0.82/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rembg:rembg:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-115924"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["rembg (\u003c 2.0.82)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Rembg"],"content_html":"\u003cp\u003eRembg versions prior to 2.0.82 contain a vulnerability in the /api/remove endpoint (CVE-2026-115924). The endpoint improperly processes the \u003ccode\u003eextras.sam_model\u003c/code\u003e parameter, passing it through \u003ccode\u003erembg/commands/s_command.py\u003c/code\u003e to \u003ccode\u003erembg/sessions/sam.py\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eAn attacker can supply a \u003ccode\u003esam_model\u003c/code\u003e value combining path traversal and URL fragment syntax. This allows the attacker to force the application to download malicious ONNX encoder and decoder files into a local path. These files can then be used to load target files via ONNX external data, enabling the disclosure of file contents through the returned PNG mask and the execution of arbitrary ONNX computation.\u003c/p\u003e\n","date_modified":"2026-10-27T17:58:11Z","date_published":"2026-10-26T21:47:12Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rembg-path-traversal/","summary":"Unauthenticated attackers can exploit a path traversal vulnerability in the Rembg /api/remove endpoint to download malicious ONNX files, leading to arbitrary ONNX computation and file disclosure.","title":"Rembg: Arbitrary file disclosure and arbitrary ONNX computation (CVE-2026-115924)","url":"https://feed.craftedsignal.io/briefs/2026-10-rembg-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Rembg (\u003c 2.0.82)","version":"https://jsonfeed.org/version/1.1"}