CVE-2026-115924

Rembg, a tool for background removal, contains a flaw that lets an unauthenticated attacker supply a specially crafted SAM model name that interleaves path‑traversal sequences with URL‑fragment syntax. The sanitization logic in the public /api/remove endpoint fails to strip the fragment part, allowing the attacker to create a local path that contains both a valid file name and a fragment marker. The first request establishes the targeted directory structure; a second identical request downloads malicious ONNX encoder and decoder files onto that path using GitHub URLs that are not pinned with a hash. Because the ONNX runtime can load external data, those files can refer to arbitrary files on the host, making the attacker read any file that the rembg process can access and embed the file’s contents into the PNG mask returned to the client. The vulnerability is a classic local‑file‑disclosure weakness (CWE‑22) and also permits arbitrary ONNX computation, potentially elevating the impact if the ONNX files perform privileged operations.

The affected product is Rembg, maintained by danielgatis. All releases prior to version 2.0.82 are vulnerable. The flaw resides in the public /api/remove endpoint and in the use of the rembg/sessions/sam.py and rembg/commands/s_command.py modules. Upgrading to 2.0.82 or later removes the ability to provide a crafted sam_model string and pins GitHub download URLs via a hash.

The CVSS score of 8.6 signals high severity, and the attack vector is unauthenticated access to a public HTTP endpoint. No EPSS score is available and the vulnerability is not listed in CISA KEV, indicating that large‑scale exploitation has not yet been observed. However, the flaw allows reading of any file readable by the rembg process and exposure of its contents over the network. The risk is confined to the filesystem accessible by the rembg user, but sensitive data could be disclosed if that user can read it. The absence of authentication on the endpoint means an attacker does not need any credentials beyond sending an HTTP request, and the combination of path traversal and uncontrolled ONNX file creation makes exploitation straightforward for a skilled adversary.