CVE-2026-40086

{
  "id": "CVE-2026-40086",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-10T17:17:12.663",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious model_path parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages. This vulnerability is fixed in 2.0.75."
    },
    {
      "lang": "es",
      "value": "Rembg es una herramienta para eliminar el fondo de imágenes. Antes de la 2.0.75, una vulnerabilidad de salto de ruta en el servidor HTTP de rembg permite a atacantes remotos no autenticados leer archivos arbitrarios del sistema de archivos del servidor. Al enviar una solicitud manipulada con un parámetro model_path malicioso, un atacante puede forzar al servidor a intentar cargar cualquier archivo como un modelo ONNX, revelando la existencia del archivo, los permisos y, potencialmente, el contenido del archivo a través de mensajes de error. Esta vulnerabilidad está corregida en la 2.0.75."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "danielgatis",
          "product": "rembg",
          "versions": [
            {
              "version": "< 2.0.75",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-10T18:29:11.164475Z",
          "id": "CVE-2026-40086",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:danielgatis:rembg:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2.0.75",
              "matchCriteriaId": "E4344D3C-49F0-4B6F-94B4-7AEBDAA57C60"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/danielgatis/rembg/commit/7c76d3cdc5757ffbda6a76664b24cfbecdb80273",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/danielgatis/rembg/releases/tag/v2.0.75",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/danielgatis/rembg/security/advisories/GHSA-3wqj-33cg-xc48",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}