HighVulnerability
CVE-2026-115924: Rembg unauthenticated file disclosure through public /api/remove endpoint
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-115924
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
Rembg versions before 2.0.82 expose the public /api/remove endpoint, which passes the attacker-controlled extras.sam_model value into SAM filenames and GitHub download URLs fetched by pooch.retrieve() without a pinned hash. An unauthenticated attacker can use path traversal combined with URL fragment syntax to make attacker-chosen ONNX encoder and decoder files download beside a target file, which the graphs can read via ONNX external data and encode into the returned PNG mask, disclosing complete files readable by the rembg process and enabling arbitrary ONNX computation.
Mitigation
This issue is fixed in version 2.0.82.
Related items
- HighCVE-2026-115915: vLLM image loading flaw allows EPS payload dispatchSimilar attack · NVD/CVE Database
- LowThe RealReal won’t let AI agents hog designer clothingSimilar attack · The Verge (AI)
- HighCVE-2026-115912: vLLM arbitrary Python execution via forged shared-memory multimodal dataSimilar attack · NVD/CVE Database
- InfoThe Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability ExploitationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- MediumOpenAI, Anthropic disclosures spotlight growing AI containment challengeSimilar attack · CSO Online