Rembg is a tool to remove images background.
CVE-2026-115924
The public /api/remove endpoint uses attacker-controlled extras.sammodel in both SAM filenames and GitHub download URLs. Path traversal plus a URL fragment lets an unauthenticated attacker place malicious ONNX models beside a target file. The models read the file as ONNX external data and encode its bytes into the returned PNG. This issue affects SAM's sammodel in 2.0.81 and returns complete file contents. Screenshot 1 — First unauthenticated request primes the path and returns HTTP 500. Technical details rembg/commands/scommand.py:188-223,384-397 accepts public extras JSON and passes it to newsession(). rembg/sessions/sam.py:313-355 inserts sammodel into encoder/decoder filenames and fixed GitHub URLs, then invokes pooch.retrieve() without a pinned hash. Requests removes the URL #fragment; the local POSIX path retains it. Pooch creates attacker-selected parent directories without enforcing cache containment. The first request creates the path tree and returns HTTP 500. The identical second request downloads the attacker asset twice and stores it as both SAM models beside the target. The graph uses a relative external tensor to read the target and maps every byte to mask pixels.…
Assessment
- CVSS
- 8.6 (v3.1)
- Severity
- High
- EPSS
- 0.00394% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 26 October 2026
- Last updated
- 31 October 2026
- Affected
- pip · rembg
- Weakness
- CWE-22
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
At the source
References
- https://github.com/danielgatis/rembg/commit/b2758c6b39bb2b02df90a03128110339476984d3
- https://github.com/danielgatis/rembg/releases/tag/v2.0.82
- https://github.com/danielgatis/rembg/security/advisories/GHSA-qr6x-7v33-6qmg
- https://nvd.nist.gov/vuln/detail/CVE-2026-115924
- https://github.com/advisories/GHSA-qr6x-7v33-6qmg
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-115924