GHSA-qr6x-7v33-6qmg: Path Traversal
The public /api/remove endpoint uses attacker-controlled extras.sammodel in both SAM filenames and GitHub download URLs. Path traversal plus a URL fragment lets an unauthenticated attacker place malicious ONNX models beside a target file. The models read the file as ONNX external data and encode its bytes into the returned PNG.
This issue affects SAM's sammodel in 2.0.81 and returns complete file contents.
<img width="2172" height="1182" alt="image" src="https://github.com/user-attachments/assets/70aacab1-5ef8-4aad-b30e-e3780adef4d2" />
Screenshot 1 — First unauthenticated request primes the path and returns HTTP 500.
Technical details
rembg/commands/scommand.py:188-223,384-397 accepts public extras JSON and passes it to newsession(). rembg/sessions/sam.py:313-355 inserts sammodel into encoder/decoder filenames and fixed GitHub URLs, then invokes pooch.retrieve() without a pinned hash.
Requests removes the URL #fragment; the local POSIX path retains it. Pooch creates attacker-selected parent directories without enforcing cache containment. The first request creates the path tree and returns HTTP 500. The identical second request downloads the attacker asset twice and stores it as both SAM models beside the target.
The graph uses a relative external tensor to read the target and maps every byte to mask pixels. rembg returns the mask as a PNG, which the attacker decodes back into the original bytes.
<img width="2432" height="1254" alt="image" src="https://github.com/user-attachments/assets/99215c39-3619-4952-8f41-5ef2034f7499" />
Screenshot 2 — The identical second request returns HTTP 200 with an encoded PNG. <img width="2858" height="1548" alt="image" src="https://github.com/user-attachments/assets/26322071-101c-41aa-a356-08a4969ef475" />
Proof of concept
The attached loopback-only PoC produced:
text VULNERABLE: unauthenticated SAM model injection disclosed the synthetic /flag first-http=500 second-http=200 decoded-value=REMBGAUDITSYNTHETICFLAG20260828
The /etc/passwd variant produced:
text VULNERABLE: disclosed /etc/passwd (839 bytes) root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin ... nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
The decoded contents matched /etc/passwd inside the owned container. Testing used a local TLS stand-in for GitHub; no public target was contacted.
<img width="1816" height="1146" alt="image" src="https://github.com/user-attachments/assets/664eaf25-5963-4ca6-b7eb-3e198499194a" />
Screenshot 3 — The decoder reconstructs all 839 bytes of /etc/passwd.
Impact
An unauthenticated attacker can execute arbitrary ONNX computation and disclose complete files that rembg can reach under the required filesystem permissions. The supplied root-running container exposed both /flag and /etc/passwd.
Remediation
Allow only fixed SAM identifiers mapped server-side to fixed filenames, URLs, and pinned hashes. Reject path and URL syntax; canonicalize destinations and enforce cache containment before creating directories. Run the container as a non-root user with a read-only root filesystem.
decodesamfragmentpng.py samfragment04.py samfragmentetcpasswdlab.py
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/rembgto a version that resolves this vulnerability.Fixed in 2.0.82 - Configuration
Replace attacker-controlled extras.sam_model values with an allowlist of fixed SAM identifiers, each mapped server-side to a fixed filename and URL with a pinned hash.
rembg SAM model selection SAM identifiers = Allow only fixed identifiers mapped server-side to fixed filenames, URLs, and pinned hashes - Configuration
Reject path and URL syntax, canonicalize destination paths, and verify they remain within the intended cache before creating directories.
Pooch model cache and path handling path and URL validation = Reject path and URL syntax; canonicalize destinations and enforce cache containment - Configuration
Run the container as a non-root user with a read-only root filesystem.
Container runtime user and root filesystem = non-root user; read-only root filesystem
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or user interaction?
No. The endpoint is public, and the issue is described as exploitable by an unauthenticated attacker without user interaction.
What request behavior may indicate an exploitation attempt?
The initial request can create the attacker-selected path tree and return HTTP 500. A repeated identical request is then used after that path has been primed.
What is the potential impact if exploitation succeeds?
A malicious ONNX model can cause a target file to be read as ONNX external data and encode its contents into the returned PNG. The issue is described as allowing complete file contents to be returned.