CVE-2026-115924: ONNX unauthenticated path traversal

Q: Is CVE-2026-115924 actively exploited?

No confirmed active exploitation of CVE-2026-115924 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-115924?

1) Upgrade rembg to 2.0.82 or later and rebuild any container images that bundle it. 2) If you cannot patch immediately, place the server behind authentication or a reverse proxy, restrict it to trusted networks, or block requests where extras.sam_model contains '..', '/', '#' or URL-like characters. 3) Run rembg as a low-privilege user in a container with a read-only root filesystem, no mounted secrets, and egress limited to required hosts, so a successful read exposes little. 4) Hunt for exploitation: review web and application logs for /api/remove requests with unusual sam_model values, unexpected files or directories in the rembg model cache (~/.u2net or the configured model path), outbound requests to GitHub paths that are not the official model releases, and abnormally large or odd PNG mask responses. 5) If exposure is suspected, rotate any secrets readable by the rembg process.

Q: What systems are affected by CVE-2026-115924?

This vulnerability affects the following AI/ML architecture patterns: model serving, image processing pipelines, inference APIs, containerized ML microservices.

Q: What is the CVSS score for CVE-2026-115924?

CVE-2026-115924 has a CVSS v3.1 base score of 8.6 (HIGH). The EPSS exploitation probability is 0.39%.

CISO Take

Rembg, a widely used background-removal library and API server, has an unauthenticated path traversal flaw in its /api/remove endpoint that lets a remote attacker make the service download attacker-controlled ONNX models and use them to read arbitrary files accessible to the rembg process. The attacker gets the file contents back encoded in the returned PNG mask, so this is a full confidentiality breach (CVSS 8.6, network, low complexity, no privileges, no user interaction), and the attacker can also run arbitrary ONNX computation on the host. No EPSS score, public exploit, Nuclei template or KEV listing exists yet, but the technique is described in the public advisory and fix commit, so weaponization is likely to be quick for any exposed instance. Teams running rembg as a network service, especially one that is internet-facing or holds credentials and API keys in readable files, should upgrade to 2.0.82 now. Until then, restrict access to the endpoint and review logs for unusual sam_model values containing traversal sequences or fragment characters.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

High. Exploitation is unauthenticated, remote and low complexity, and the advisory and fix commit describe the technique in enough detail to reproduce. Impact is mostly confidentiality (full disclosure of any file readable by the rembg process, such as environment files, cloud credentials and application secrets), with limited integrity and availability impact from planting files and running arbitrary ONNX graphs. Exposure is limited to deployments that run the HTTP server (rembg s) and expose it to untrusted networks. Library-only use is not affected by this attack path. There is no known active exploitation, public exploit or KEV listing at this time, and EPSS is unavailable.

How does the attack unfold?

Initial Access

Attacker sends an unauthenticated request to the public /api/remove endpoint with a crafted extras.sam_model value combining path traversal and a URL fragment.

AML.T0049

Staging

The first request creates the attacker-selected path tree, and the repeated request makes rembg download malicious ONNX encoder and decoder files beside the target file via pooch.retrieve() with no pinned hash.

AML.T0010.003

Collection

The malicious ONNX graphs load the target file as external data and run arbitrary computation inside the inference runtime.

AML.T0037

Exfiltration

File bytes are encoded into the returned PNG mask, giving the attacker the full contents of any file the rembg process can read.

AML.T0025

Initial Access

Attacker sends an unauthenticated request to the public /api/remove endpoint with a crafted extras.sam_model value combining path traversal and a URL fragment.

AML.T0049

Staging

The first request creates the attacker-selected path tree, and the repeated request makes rembg download malicious ONNX encoder and decoder files beside the target file via pooch.retrieve() with no pinned hash.

AML.T0010.003

Collection

The malicious ONNX graphs load the target file as external data and run arbitrary computation inside the inference runtime.

AML.T0037

Exfiltration

File bytes are encoded into the returned PNG mask, giving the attacker the full contents of any file the rembg process can read.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
ONNX	pip	< 2.0.82	`2.0.82`
21.6KOpenSSF 8.31.1K dependentsPushed 6d ago82% patched~33d to patchFull package profile →

Do you use ONNX? You're affected.

How severe is it?

CVSS 3.1

8.6 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

ILow

ALow

What should I do?

1 step

1) Upgrade rembg to 2.0.82 or later and rebuild any container images that bundle it. 2) If you cannot patch immediately, place the server behind authentication or a reverse proxy, restrict it to trusted networks, or block requests where extras.sam_model contains '..', '/', '#' or URL-like characters. 3) Run rembg as a low-privilege user in a container with a read-only root filesystem, no mounted secrets, and egress limited to required hosts, so a successful read exposes little. 4) Hunt for exploitation: review web and application logs for /api/remove requests with unusual sam_model values, unexpected files or directories in the rembg model cache (~/.u2net or the configured model path), outbound requests to GitHub paths that are not the official model releases, and abnormally large or odd PNG mask responses. 5) If exposure is suspected, rotate any secrets readable by the rembg process.

How is it classified?

Data ExtractionSupply ChainData LeakageFrameworkAPIInferenceAML.T0010.003- Model AML.T0025- Exfiltration via Cyber Means AML.T0037- Data from Local System AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Responses to unknown risks and incidents

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-115924?

Rembg, a widely used background-removal library and API server, has an unauthenticated path traversal flaw in its /api/remove endpoint that lets a remote attacker make the service download attacker-controlled ONNX models and use them to read arbitrary files accessible to the rembg process. The attacker gets the file contents back encoded in the returned PNG mask, so this is a full confidentiality breach (CVSS 8.6, network, low complexity, no privileges, no user interaction), and the attacker can also run arbitrary ONNX computation on the host. No EPSS score, public exploit, Nuclei template or KEV listing exists yet, but the technique is described in the public advisory and fix commit, so weaponization is likely to be quick for any exposed instance. Teams running rembg as a network service, especially one that is internet-facing or holds credentials and API keys in readable files, should upgrade to 2.0.82 now. Until then, restrict access to the endpoint and review logs for unusual sam_model values containing traversal sequences or fragment characters.

Is CVE-2026-115924 actively exploited?

No confirmed active exploitation of CVE-2026-115924 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-115924?

1) Upgrade rembg to 2.0.82 or later and rebuild any container images that bundle it. 2) If you cannot patch immediately, place the server behind authentication or a reverse proxy, restrict it to trusted networks, or block requests where extras.sam_model contains '..', '/', '#' or URL-like characters. 3) Run rembg as a low-privilege user in a container with a read-only root filesystem, no mounted secrets, and egress limited to required hosts, so a successful read exposes little. 4) Hunt for exploitation: review web and application logs for /api/remove requests with unusual sam_model values, unexpected files or directories in the rembg model cache (~/.u2net or the configured model path), outbound requests to GitHub paths that are not the official model releases, and abnormally large or odd PNG mask responses. 5) If exposure is suspected, rotate any secrets readable by the rembg process.

What systems are affected by CVE-2026-115924?

This vulnerability affects the following AI/ML architecture patterns: model serving, image processing pipelines, inference APIs, containerized ML microservices.

What is the CVSS score for CVE-2026-115924?

CVE-2026-115924 has a CVSS v3.1 base score of 8.6 (HIGH). The EPSS exploitation probability is 0.39%.

What is the AI security impact?

Affected AI Architectures

model servingimage processing pipelinesinference APIscontainerized ML microservices

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0025Exfiltration via Cyber Means

AML.T0037Data from Local System

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sam_model through rembg/commands/s_command.py to rembg/sessions/sam.py, where it is interpolated into SAM filenames and GitHub download URLs passed to pooch.retrieve() without a pinned hash. An unauthenticated attacker can supply a sam_model value combining path traversal with URL fragment syntax to exploit the HTTP request discarding the fragment while the local POSIX path retains it. The first request primes the attacker-selected path tree, and an identical repeated request downloads malicious ONNX encoder and decoder files beside a readable target file. The graphs can load the target through ONNX external data and encode its bytes into the returned PNG mask, disclosing complete files accessible to the rembg process and allowing arbitrary ONNX computation. This issue is fixed in version 2.0.82.

Exploitation Scenario

An attacker finds an internet-facing rembg API used by an image-processing service. They send a first POST to /api/remove with extras.sam_model set to a traversal path plus a URL fragment, which causes the server to prepare a directory tree at a location of the attacker's choosing while the HTTP download ignores the fragment. A second identical request makes the server download the attacker's malicious ONNX encoder and decoder files next to a target file such as the application's .env or a cloud credentials file. The malicious graphs load the target as ONNX external data and encode its bytes into the returned PNG mask, which the attacker decodes to recover the secrets and then uses them to pivot into cloud storage, databases or other AI infrastructure.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.