Path Traversal Vulnerability in Leon by Leon AI

CVE-2026-116073

What is CVE-2026-116073?

The Leon product prior to commit 50df142 is susceptible to a path traversal vulnerability within the getModelFileNameFromURL() function. This flaw allows malicious actors to craft URLs containing encoded '../' sequences, enabling them to write files outside the models directory. When a user executes the '/download model' command with a compromised URL, it can lead to the unauthorized disclosure of sensitive data or the manipulation of files in arbitrary writable paths managed by Leon. Users of affected versions should upgrade to protect against potential exploitation.

References