CVE-2026-115924 in rembg
Summary
by MITRE • 10/26/2026
Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sam_model through rembg/commands/s_command.py to rembg/sessions/sam.py, where it is interpolated into SAM filenames and GitHub download URLs passed to pooch.retrieve() without a pinned hash. An unauthenticated attacker can supply a sam_model value combining path traversal with URL fragment syntax to exploit the HTTP request discarding the fragment while the local POSIX path retains it. The first request primes the attacker-selected path tree, and an identical repeated request downloads malicious ONNX encoder and decoder files beside a readable target file. The graphs can load the target through ONNX external data and encode its bytes into the returned PNG mask, disclosing complete files accessible to the rembg process and allowing arbitrary ONNX computation. This issue is fixed in version 2.0.82.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in Rembg versions prior to 2.0.82 represents a critical server-side request forgery combined with path traversal, leading to unauthorized file disclosure and remote code execution via malicious model files. The root cause lies in the handling of user-supplied input within the public /api/remove endpoint. Specifically, the application accepts an attacker-controlled parameter named sam_model through rembg/commands/s_command.py and passes it directly into rembg/sessions/sam.py for processing. This value is interpolated into filenames and GitHub download URLs which are subsequently passed to the pooch.retrieve() function. The security flaw stems from a lack of input validation and sanitization, allowing an unauthenticated attacker to manipulate these values without restriction.
The exploitation mechanism relies on a sophisticated interaction between HTTP protocol behavior and POSIX file system semantics. An attacker can supply a sam_model value that combines path traversal sequences with URL fragment syntax (the portion following the hash symbol). When this malformed URL is processed by the underlying library, the HTTP client discards the fragment during the network request to GitHub. However, on the local operating system, the fragment characters are retained as part of the file path string due to POSIX conventions where fragments do not inherently invalidate a path structure in all contexts or libraries. This discrepancy allows the attacker to prime a specific directory tree with an initial request and then execute a second identical request that downloads malicious ONNX encoder and decoder files directly beside sensitive, readable target files on the server's filesystem.
The operational impact of this vulnerability is severe, encompassing both data exfiltration and arbitrary code execution. Once the malicious ONNX model files are placed in proximity to accessible targets, they can be loaded through ONNX external data mechanisms. This allows the attacker to encode the bytes of a target file into the returned PNG mask image, effectively disclosing complete contents of any file readable by the rembg process user account. Furthermore, because the downloaded models contain arbitrary computation logic, their execution constitutes remote code execution on the server hosting the Rembg instance. This dual impact means that an unauthenticated attacker can not only steal sensitive data but also potentially gain full control over the underlying system depending on the privileges of the application process.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-78 OS Command Injection in its broader implications, though it is most precisely categorized under CWE-94 Server-Side Request Forgery (SSRF) due to the manipulation of external resource retrieval. In terms of attack tactics, this exploits ATT&CK technique T1563 Remote Service Session Hijacking or more accurately T1078 Valid Accounts if authentication were required, but since it is unauthenticated, it falls under initial access vectors involving trusted software supply chain compromise via T1195 Supply Chain Compromise. The specific mechanism of using external data to exfiltrate files relates to data staging and collection techniques found in ATT&CK sub-techniques related to file discovery and transfer.
Mitigation for this vulnerability requires immediate upgrading to version 2.0.82 or later, where the issue has been resolved by implementing strict input validation on the sam_model parameter. Developers should ensure that all user-supplied inputs used in constructing file paths or URLs are sanitized against path traversal sequences such as ../ and validated against a whitelist of allowed values if possible. Additionally, when using libraries like pooch for downloading external resources, it is critical to enforce pinned hashes for downloaded files to prevent tampering with the model weights themselves. Implementing strict URL parsing that normalizes fragments before file system operations can also help mitigate similar discrepancies between network protocols and local OS behaviors in other applications relying on similar patterns.