CVE-2026-116073 in Leon
Summary
by MITRE • 10/25/2026
Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../' sequences to write attacker-controlled content to arbitrary paths writable by Leon.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in versions of Leon prior to commit 50df142 represents a critical path traversal flaw within the getModelFileNameFromURL function, which is responsible for processing URLs associated with model downloads. This security defect stems from an insufficient validation mechanism when handling percent-encoded characters in URL parameters. Specifically, the application fails to properly decode and sanitize input before determining the target file path, allowing attackers to inject directory traversal sequences such as ../ that have been encoded using standard percent-encoding techniques like %2e%2e%2f or similar variations. This oversight enables an attacker to manipulate the intended destination of a downloaded model file, effectively bypassing the application's restriction that confines downloads strictly within the designated models directory.
From a technical perspective, this flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes vulnerabilities where software does not properly neutralize special elements within a pathname so that it affects the intended file system access control. The operational impact of this vulnerability is severe because it allows for arbitrary file write operations on the host system. By tricking an authenticated user into accessing a crafted URL via the /download model endpoint, an attacker can cause Leon to overwrite existing files or create new malicious files in any directory where the application process has write permissions. This capability transforms a simple download feature into a vector for remote code execution if writable directories contain executable scripts or configuration files that are subsequently loaded by the system.
The exploitation scenario typically involves social engineering, as it requires convincing a user to interact with a specially constructed URL. Once triggered, the backend service processes the encoded traversal sequences without adequate normalization checks, resulting in the file being written outside the sandboxed models directory. This behavior aligns with ATT&CK technique T1059: Command and Scripting Interpreter if the overwritten files are scripts that can be executed later, or more broadly falls under lateral movement and persistence mechanisms depending on where the files are placed. The lack of strict input validation allows for a wide range of malicious payloads to be delivered through this channel, potentially compromising the integrity of the entire system hosting Leon.
Mitigation strategies must focus on implementing robust input sanitization and path canonicalization checks within the getModelFileNameFromURL function. Developers should ensure that all URL parameters are decoded before processing and then validated against an allowlist or verified using absolute path resolution to confirm they remain within the expected directory structure. Additionally, employing principle of least privilege for the application process can limit the damage if a traversal attempt succeeds by restricting write access only to necessary directories. Upgrading to version 50df142 or later is essential as it addresses this specific flaw through improved handling of encoded separators and stricter boundary enforcement for file operations.