CVE-2026-40086: danielgatis rembg path traversal in HTTP server custom model loading

CVE-2026-40086 · Severity: medium · CVSS 5.3 · Published 2026-04-10

Rembg is a tool used to remove backgrounds from images. A security flaw in its HTTP server mode allows an attacker to trick the system into trying to load any file on the server as a machine learning model. This can be used to confirm the existence of sensitive files, check system permissions, or potentially crash the service by attempting to load extremely large files.

Technologies: Danielgatis Rembg, rembg (PyPI). Vendors: Danielgatis, PyPI.

Quick answers

Is CVE-2026-40086 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40086 being exploited in the wild.
How severe is CVE-2026-40086?
Medium severity, with a CVSS score of 5.3, published 10 April 2026.
Which products and versions are affected?
Danielgatis Rembg < 2.0.75; rembg (PyPI) ECOSYSTEM:introduced=0,fixed=2.0.75.
Is there a fix for CVE-2026-40086?
Yes. rembg (PyPI): upgrade to 2.0.75 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40086 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40086?
Check whether you run Danielgatis Rembg or rembg (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • rembg (PyPI): upgrade to 2.0.75 or later
    pip install "rembg>=2.0.75"

Technical details

A path traversal vulnerability exists in the rembg HTTP server when handling custom model types (u2net_custom, dis_custom, ben_custom). The 'extras' JSON parameter is parsed without validation in 'rembg/commands/s_command.py' and passed to 'new_session()'. The 'model_path' within these extras is then processed by 'os.path.abspath' and 'os.path.expanduser' without being restricted to a safe directory. Finally, 'onnxruntime.InferenceSession' attempts to load the file at the attacker-provided path. While the file is not returned directly, error messages from the ONNX runtime reveal whether a file exists, its accessibility, and whether it was successfully read, enabling file enumeration and information disclosure. This is patched in version 2.0.75.

Affected products

  • danielgatis rembg < 2.0.75

Identifiers

  • CVE-2026-40086
  • GHSA-3wqj-33cg-xc48
  • PYSEC-2026-2274

Timeline

  • 2026-04-09: disclosed
  • 2026-04-10: advisory
  • 2026-04-10: patched: Fixed in version 2.0.75

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.