Path Traversal and Remote Code Execution in Rembg Tool

CVE-2026-115924

What is CVE-2026-115924?

Rembg, an image background removal tool, prior to version 2.0.82, allows unauthenticated attackers to exploit a vulnerability in the /api/remove endpoint. This occurs through the manipulation of the extras.sam_model parameter, which enables the attacker to execute path traversal and obtain sensitive information. By utilizing URL fragment syntax to bypass protections, attackers can download malicious ONNX encoder and decoder files next to the target files. In effect, this vulnerability could lead to arbitrary code execution and significant data exposure, making users of earlier versions susceptible to exploitation.

References