Executive brief
Rembg is a tool used to remove backgrounds from images. A security flaw in its HTTP server mode allows an attacker to trick the system into trying to load any file on the server as a machine learning model. This can be used to confirm the existence of sensitive files, check system permissions, or potentially crash the service by attempting to load extremely large files.
Technical details
A path traversal vulnerability exists in the rembg HTTP server when handling custom model types (u2net_custom, dis_custom, ben_custom). The 'extras' JSON parameter is parsed without validation in 'rembg/commands/s_command.py' and passed to 'new_session()'. The 'model_path' within these extras is then processed by 'os.path.abspath' and 'os.path.expanduser' without being restricted to a safe directory. Finally, 'onnxruntime.InferenceSession' attempts to load the file at the attacker-provided path. While the file is not returned directly, error messages from the ONNX runtime reveal whether a file exists, its accessibility, and whether it was successfully read, enabling file enumeration and information disclosure. This is patched in version 2.0.75.
Affected products
- danielgatis rembg < 2.0.75
Timeline
- 2026-04-09: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in version 2.0.75