CVE-2026-40086

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40086
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40086.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40086
Aliases
Published
2026-04-10T16:16:28.850Z
Modified
2026-07-08T08:13:12.216222456Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Rembg has a Path Traversal via Custom Model Loading
Details

Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious model_path parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages. This vulnerability is fixed in 2.0.75.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40086.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-73"
    ]
}
References

Affected packages

Git / github.com/danielgatis/rembg

Affected ranges

Type
GIT
Repo
https://github.com/danielgatis/rembg
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7b8de60ef9fc225af1768d81aa09da29db22a355
Fixed
7c76d3cdc5757ffbda6a76664b24cfbecdb80273
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:danielgatis:rembg:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.75"
        }
    ]
}

Affected versions

v0.*
v0.0.0
v1.*
v1.0.31
v2.*
v2.0.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.16
v2.0.17
v2.0.18
v2.0.19
v2.0.2
v2.0.20
v2.0.21
v2.0.22
v2.0.23
v2.0.24
v2.0.25
v2.0.26
v2.0.27
v2.0.28
v2.0.29
v2.0.3
v2.0.30
v2.0.31
v2.0.32
v2.0.33
v2.0.34
v2.0.35
v2.0.36
v2.0.37
v2.0.38
v2.0.39
v2.0.4
v2.0.40
v2.0.41
v2.0.42
v2.0.43
v2.0.44
v2.0.45
v2.0.46
v2.0.47
v2.0.48
v2.0.49
v2.0.5
v2.0.50
v2.0.51
v2.0.52
v2.0.53
v2.0.54
v2.0.55
v2.0.56
v2.0.57
v2.0.58
v2.0.59
v2.0.6
v2.0.60
v2.0.61
v2.0.62
v2.0.63
v2.0.64
v2.0.65
v2.0.66
v2.0.67
v2.0.68
v2.0.69
v2.0.7
v2.0.70
v2.0.71
v2.0.72
v2.0.73
v2.0.74
v2.0.8
v2.0.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40086.json"