Rembg: Path traversal and local file disclosure via sam_model
Summary
Rembg, a Python tool for removing image backgrounds, passes the attacker-controllable sam_model value of the public /api/remove endpoint into SAM file names and GitHub download URLs without validation or a pinned hash. An unauthenticated attacker can use path traversal combined with URL fragment syntax to place malicious ONNX files next to a readable target file. The crafted ONNX graphs can read complete files accessible to the rembg process and encode them into the returned PNG mask, and they allow arbitrary ONNX computation. The risk is highest where the rembg HTTP server (rembg s) is reachable from untrusted networks.
Affected
- rembg versions before 2.0.82
- Per VulDB, up to and including 2.0.81
Fixed in
- Fixed in rembg 2.0.82 (commit b2758c6b39bb2b02df90a03128110339476984d3)
- The fix allows only published SAM checkpoint names and verifies downloads against upstream checksums
Workaround
- No vendor workaround known.
- Restrict access to the rembg s HTTP endpoint to trusted clients or take it off the network (not verified by the vendor).
- Block outbound access from the host to GitHub where possible (not verified by the vendor).
- Review the file permissions of the service account running rembg.
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: partial.
- Not known to be exploited in the wild.
- The GHSA page includes reproduction screenshots; no standalone public exploit code was found.
Our recommendation
- Inventory all rembg installations, including containers, lock files and requirements files, and identify versions below 2.0.82.
- Upgrade to rembg 2.0.82 or later.
- Until the upgrade is done, restrict network access to the rembg s endpoint and limit the files readable by the service account.
- Monitor the GHSA and NVD entries for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-qr6x-7v33-6qmg github.com
- rembg release v2.0.82 github.com
- Fix commit b2758c6 github.com
- OSV entry GHSA-qr6x-7v33-6qmg osv.dev
- GitLab Advisory Database entry CVE-2026-115924 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:05.
Original description (NVD)
Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sam_model through rembg/commands/s_command.py to rembg/sessions/sam.py, where it is interpolated into SAM filenames and GitHub download URLs passed to pooch.retrieve() without a pinned hash. An unauthenticated attacker can supply a sam_model value combining path traversal with URL fragment syntax to exploit the HTTP request discarding the fragment while the local POSIX path retains it. The first request primes the attacker-selected path tree, and an identical repeated request downloads malicious ONNX encoder and decoder files beside a readable target file. The graphs can load the target through ONNX external data and encode its bytes into the returned PNG mask, disclosing complete files accessible to the rembg process and allowing arbitrary ONNX computation. This issue is fixed in version 2.0.82.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.