Rembg 未授權 SAM 模型注入漏洞可透過惡意 ONNX 圖形讀取本地檔案
CVE-2026-115924 - Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
Rembg 發布的 CVE-2026-115924 漏洞允許未授權使用者透過惡意 ONNX 圖形讀取本地檔案，並執行任意 ONNX 程式。
- 漏洞機制：未驗證的
sam_model引數可結合路徑穿越與 URL 片段語法，導致本地檔案被下載並以 ONNX 外部資料載入，進而編碼為 PNG 掩碼。
此漏洞使未授權使用者能透過惡意 ONNX 圖形讀取本地檔案，提醒使用者即時升級至 2.0.82 以保護資料安全，並避免惡意程式執行。
Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sam_model through rembg/commands/s_command.py to rembg/sessions/sam.py, where it is interpolated into SAM filenames and GitHub download URLs passed to pooch.retrieve() without a pinned hash. An unauthenticated attacker can supply a sam_model value combining path traversal with URL fragment syntax to exploit the HTTP request discarding the fragment while the local POSIX path retains it. The first request primes the attacker-selected path tree, and an identical repeated request downloads malicious ONNX encoder and decoder files beside a readable target file. The graphs can load the target through ONNX external data and encode its bytes into the returned PNG mask, disclosing complete files accessible to the rembg process and allowing arbitrary ONNX computation. This issue is fixed in version 2.0.82.
Impact
Affected Products
The following products are affected by CVE-2026-115924
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
| ID | Vendor | Product | Action |
|---|---|---|---|
| 1 | Danielgatis | rembg |
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 3.1 | HIGH | [email protected] |
Update rembg to version 2.0.82 or later to patch the path traversal vulnerability.
- Update rembg to version 2.0.82.
- Verify the sam_model input is properly sanitized.
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-115924.
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-115924 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-115924
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-115924 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-115924 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by [email protected]
十月. 26, 2026
Action Type Old Value New Value Added Description Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes attacker-controlled extras.sam_model through rembg/commands/s_command.py to rembg/sessions/sam.py, where it is interpolated into SAM filenames and GitHub download URLs passed to pooch.retrieve() without a pinned hash. An unauthenticated attacker can supply a sam_model value combining path traversal with URL fragment syntax to exploit the HTTP request discarding the fragment while the local POSIX path retains it. The first request primes the attacker-selected path tree, and an identical repeated request downloads malicious ONNX encoder and decoder files beside a readable target file. The graphs can load the target through ONNX external data and encode its bytes into the returned PNG mask, disclosing complete files accessible to the rembg process and allowing arbitrary ONNX computation. This issue is fixed in version 2.0.82. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L Added CWE CWE-22 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/115xxx/CVE-2026-115924.json">CVE-2026-115924</a> Added Reference https://github.com/danielgatis/rembg/commit/b2758c6b39bb2b02df90a03128110339476984d3 Added Reference https://github.com/danielgatis/rembg/releases/tag/v2.0.82 Added Reference https://github.com/danielgatis/rembg/security/advisories/GHSA-qr6x-7v33-6qmg
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.