rembg EUVD-2026-110073

Exploitation requires rembg (prior to 2.0.82) running in HTTP server mode with the public /api/remove endpoint reachable by the attacker, who supplies attacker-controlled extras.sam_model JSON; no authentication is needed (PR:N). The attack specifically needs a sam_model value combining path traversal with URL-fragment syntax so the HTTP request drops the '#fragment' while the local POSIX path retains it, and it requires two identical requests (the first primes the attacker-selected directory tree and returns HTTP 500, the second downloads the malicious ONNX assets and returns the encoded PNG). The disclosed data is limited to files readable by the rembg process under its filesystem permissions - the advisory's demonstration ran the container as root, which maximized reach to /flag and /etc/passwd; a non-root, read-only-root-filesystem deployment constrains the impact.

This is a genuinely high-priority issue rather than a high-CVSS-but-low-real-risk one, though its reach is gated by deployment mode. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, computing to 8.6) describes a network-reachable, unauthenticated, low-complexity attack against the public /api/remove endpoint, with high confidentiality impact (complete file disclosure) plus limited integrity/availability impact from writing attacker ONNX assets to disk. The vuln.today decision label is 'this_week' (not act_now/emergency). A public PoC reference exists in the GHSA advisory (attached scripts), but it is a loopback-only lab demonstration and is not verified as a weaponized in-the-wild exploit - POC availability must not be conflated with active exploitation. No CISA KEV listing is present and no EPSS score was supplied, so widespread-versus-targeted exploitation cannot be gauged from the input; the absence of KEV/EPSS is a data gap, not evidence of low risk. The practical limiter is that the host must be running rembg in HTTP server mode with /api/remove exposed, and impact is bounded by the filesystem permissions of the rembg process (the advisory's root-running container exposed /flag and /etc/passwd).

An unauthenticated attacker reaches a publicly exposed rembg /api/remove endpoint and submits an extras.sam_model value that combines path traversal with URL-fragment syntax, exploiting the fact that the HTTP client discards the URL '#fragment' while the local POSIX path keeps it. The first request primes the attacker-chosen directory tree (returning HTTP 500) and an identical second request fetches malicious ONNX encoder/decoder files beside a readable target file; the graph reads that file via ONNX external data and encodes its bytes into the returned PNG mask, which the attacker decodes back to the original file. A public PoC reference exists (loopback-only), demonstrating disclosure of /etc/passwd and a synthetic /flag.