EUVD-2026-109387
GHSA-5jhh-46x7-49hp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft URL with encoded ../ filename
-
DeliveryTrick user into running '/download model'
-
ExploitDecode reconstitutes path separators
-
ExecutionWrite file outside models directory
-
ImpactOverwrite attacker-chosen path writable by Leon
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a victim with a Leon instance to actively execute the '/download model' built-in command against an attacker-supplied URL whose final path segment percent-encodes '../' or '..\' separators (decoded in getModelFileNameFromURL before the fix). Exploitation is limited by: (1) mandatory user interaction/social engineering (CVSS UI:A) - the operator must be tricked into running the command with the malicious URL; (2) the write is constrained to filesystem paths the Leon process can write; (3) only unpatched builds before commit 50df142 are affected. No authentication of the attacker is involved (PR:N), but no exploitation occurs without the operator action. |
| Impact | This is a genuine but moderate-priority integrity flaw, not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N) scores 6.9 and the signals are internally consistent: network delivery and low complexity are offset by the hard requirement for active user interaction (UI:A) - the victim must be socially engineered into running '/download model' against an attacker-crafted URL, which is the dominant limiting factor. Impact is integrity-only (VI:H, VC:N/VA:N): arbitrary file write to any path the Leon process can write, with no direct confidentiality or availability loss, though a crafted write could escalate to code execution depending on what is overwritten. The vuln.today decision label is 'this_month' (not act_now/emergency), and no EPSS score, CISA KEV listing, or confirmed working exploit was supplied. The only exploitation-status signal is that VulnCheck reported it and a patch exists; there is no evidence of active exploitation or weaponized PoC. Net: a real, patchable issue warranting scheduled remediation, with practical risk bounded by the social-engineering prerequisite rather than raw remote-unauthenticated reach. |
| Exploit ScenarioDerived | An attacker crafts a model download URL whose final path segment percent-encodes '../' sequences (e.g. encoded '../../../evil.gguf') and persuades a Leon operator to run '/download model' against it. When getModelFileNameFromURL() decodes the segment, the separators reconstitute and the download is written outside the llm models directory to an attacker-chosen path writable by Leon, planting attacker-controlled content. No public working exploit code was identified at time of analysis, though the fix commit's test cases demonstrate the exact bypass strings. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 25, 2026
Path traversal in Leon's built-in '/download model' command lets an attacker who supplies a crafted model URL write attacker-controlled content to arbitrary filesystem paths writable by the Leon process, escaping the intended LLM models directory. All Leon builds prior to commit 50df142 are affected (CPE cpe:2.3:a:leon-ai:leon:*), and exploitation depends on the operator being tricked into running '/download model' with a URL whose final segment percent-encodes '../' or '..\' separators - the assessed vector is AV:N/AC:L/PR:N/UI:R with integrity-only impact (I:H, C:N/A:N), so no attacker authentication is needed but no write occurs without that operator action. No CISA KEV listing or EPSS signal was present in the supplied intelligence; the upstream fix includes regression tests that exercise the encoded-traversal payloads, but no verified public exploit code was identified. This is a genuine but moderate-priority integrity flaw, not a drop-everything emergency, and a maintainer fix exists in commit 50df142 (PR #594).
RemediationAI
Vendor-released patch: commit 50df142a89a0859e5b7283d87afdab7b01e712a2 (merged as PR #594 at github.com/leon-ai/leon/pull/594), which decodes only the final raw path segment, rejects '', '.', '..' and decoded names containing '/' or '\\', and verifies with path.resolve() that the download destination stays inside LLM_DIR_PATH; no tagged release version was specified in the available data, so confirm your build includes that commit before considering the instance fixed (tracked via github.com/leon-ai/leon/issues/593 and the VulnCheck advisory). Because exploitation requires the operator to run '/download model' with an attacker-supplied URL (UI:A in both the CVSS 4.0 and assessed 3.1 vectors), the practical interim control is procedural: do not execute '/download model' against URLs received from untrusted or unsolicited sources, and fetch model files out-of-band, placing them directly in the LLM models directory - this costs operator convenience and does not fix the underlying decode ordering bug. Tightening the filesystem write permissions of the Leon process to the models directory plus its own runtime paths reduces the blast radius of a successful traversal, at the risk of breaking legitimate downloads or logging if those paths fall outside the granted scope; neither workaround substitutes for applying commit 50df142.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Leon is a Node.js/TypeScript personal assistant whose server implements built-in commands; the download command fetches an LLM model file from a user-supplied URL into LLM_DIR_PATH. In the vulnerable code path (server/src/built-in-command/commands/download-command/download-command.ts, lines 21-28), the file name was derived as decodeURIComponent(path.basename(parsedURL.pathname)) - the basename was taken from the still-encoded path and only then percent-decoded, so an encoded sequence such as %2e%2e%2f survives basename() as a single 'segment' and decodes into real '../' separators before being joined to the models directory. That ordering error is the root cause class, CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal), yielding a write-outside-intended-directory primitive rather than read or code execution. The fix in PR #594 addresses it in two layers: it decodes only the last raw path segment and rejects empty names, '.', '..', and any decoded string containing '/' or '\\'; and it re-resolves the computed destination and the LLM_DIR_PATH with path.resolve(), throwing if the destination does not begin with the models directory plus path.sep. The accompanying unit tests confirm both that a benign nested URL (https://example.com/sub/dir/model.gguf) lands at LLM_DIR_PATH/model.gguf and that encoded '../../../evil.gguf' and '..\..\..\evil.gguf' payloads are rejected before any download occurs.
Know when Leon gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Attacker needs no privileges (PR:N) but the operator must run the command (UI:R); impact is arbitrary file write, so I:H with C:N/A:N and scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../' sequences to write attacker-controlled content to arbitrary paths writable by Leon.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB