Leon
Monthly
Path traversal in Leon's built-in '/download model' command lets an attacker who supplies a crafted model URL write attacker-controlled content to arbitrary filesystem paths writable by the Leon process, escaping the intended LLM models directory. All Leon builds prior to commit 50df142 are affected (CPE cpe:2.3:a:leon-ai:leon:*), and exploitation depends on the operator being tricked into running '/download model' with a URL whose final segment percent-encodes '../' or '..\' separators - the assessed vector is AV:N/AC:L/PR:N/UI:R with integrity-only impact (I:H, C:N/A:N), so no attacker authentication is needed but no write occurs without that operator action. No CISA KEV listing or EPSS signal was present in the supplied intelligence; the upstream fix includes regression tests that exercise the encoded-traversal payloads, but no verified public exploit code was identified. This is a genuine but moderate-priority integrity flaw, not a drop-everything emergency, and a maintainer fix exists in commit 50df142 (PR #594).
Path traversal in Leon's built-in '/download model' command lets an attacker who supplies a crafted model URL write attacker-controlled content to arbitrary filesystem paths writable by the Leon process, escaping the intended LLM models directory. All Leon builds prior to commit 50df142 are affected (CPE cpe:2.3:a:leon-ai:leon:*), and exploitation depends on the operator being tricked into running '/download model' with a URL whose final segment percent-encodes '../' or '..\' separators - the assessed vector is AV:N/AC:L/PR:N/UI:R with integrity-only impact (I:H, C:N/A:N), so no attacker authentication is needed but no write occurs without that operator action. No CISA KEV listing or EPSS signal was present in the supplied intelligence; the upstream fix includes regression tests that exercise the encoded-traversal payloads, but no verified public exploit code was identified. This is a genuine but moderate-priority integrity flaw, not a drop-everything emergency, and a maintainer fix exists in commit 50df142 (PR #594).