CVE-2026-115924

Rembg model selection can disclose local files through generated masks

Rembg project · Rembg SAM image-background removal service

First documented disclosure · Review checkpoint

Summary

An unauthenticated caller could make the service load attacker-supplied ONNX models and return readable local-file contents in an image.

Severity and exploitation evidence

High · 8.6/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Unconstrained SAM model names influenced download URLs and local paths; ONNX external-data loading crossed the intended model-cache boundary.

Conditions required

Access to the public removal endpoint, model retrieval, and filesystem permissions allowing access to the target file.

Potential impact

Disclosure of files readable by the service and arbitrary ONNX computation.

Affected versions and configurations

Before 2.0.82 per the CNA; the maintainer’s demonstration uses 2.0.81.

Fix and mitigation status

2.0.82.

Practical next steps

Upgrade, restrict model identifiers to fixed verified assets, and run with limited filesystem access.

Operating lesson

Treat model files and their external-data references as untrusted inputs with filesystem authority.

Evidence and limits

Maintainer publication September 8 predates October 26 CVE publication and October 27 global-advisory indexing. Tests used an owned container and local TLS stand-in; no public victim was attacked. Arbitrary ONNX computation is not proof of arbitrary operating-system command execution.

Sources