Technical impact
Leon implements a /download model command that extracts a file name from a supplied URL to write a file under its models directory. The current implementation fails to correctly reject percent‑encoded directory separators, allowing an attacker to include encoded '../' sequences and cause the server to write an attacker‑controlled file outside the intended directory. This flaw permits the creation or modification of arbitrary files on the underlying host, which may lead to further compromise if the written content is executable or misconfigures the system.
Affected Systems
Versions of the leon-ai:leon product released before commit 50df142 are affected. No specific patch version is listed, indicating that any release built from the repository state that contains commit 50df142 or later has the vulnerability removed. The vulnerability is present across the entire range of products that include the legacy download‑model command.
Risk and Exploitability
The CVSS score of 6.9 classifies the weakness as high severity with potential for significant impact. Exploitation requires the victim to run the /download model command with a crafted URL, meaning a social engineering or phishing vector is the likely attack path. Since EPSS is not available and the flaw is not listed as a known exploited vulnerability by CISA, the risk remains primarily theoretical but not negligible for environments where users may unknowingly execute the command against untrusted URLs.
