Summary
Rembg's public image-background removal endpoint can be abused through a crafted sam_model value that combines path traversal with URL fragment behavior. An unauthenticated attacker may cause malicious ONNX files to be placed near a readable target and use them to disclose files accessible to the Rembg process through the returned image mask.
Rembg's public image-background removal endpoint can be abused through a crafted sam_model value that combines path traversal with URL fragment behavior. An unauthenticated attacker may cause malicious ONNX files to be placed near a readable target and use them to disclose files accessible to the Rembg process through the returned image mask.
Affected context
The vulnerability affects Rembg deployments that expose the public /api/remove endpoint and allow client-controlled extras.sam_model values to influence SAM model filenames and download URLs. Risk is increased when the service can write to and read from paths outside its intended model directory, and when downloaded model artifacts are accepted without integrity verification or strict location controls.
The vulnerability affects Rembg deployments that expose the public /api/remove endpoint and allow client-controlled extras.sam_model values to influence SAM model filenames and download URLs. Risk is increased when the service can write to and read from paths outside its intended model directory, and when downloaded model artifacts are accepted without integrity verification or strict location controls.
Exploit preconditions
- Attack surface: Public HTTP image-processing API
- Required access: Network access to the unauthenticated
/api/removeendpoint - Trigger point: Processing of the attacker-controlled
extras.sam_modelvalue and retrieval of SAM model artifacts - Why exploitation is possible: The value influences both local filesystem paths and remote download URLs; inconsistent handling of URL fragments and filesystem path components can place attacker-controlled ONNX files beside a readable target and cause them to be loaded
- Attack surface: Public HTTP image-processing API
- Required access: Network access to the unauthenticated
/api/removeendpoint - Trigger point: Processing of the attacker-controlled
extras.sam_modelvalue and retrieval of SAM model artifacts - Why exploitation is possible: The value influences both local filesystem paths and remote download URLs; inconsistent handling of URL fragments and filesystem path components can place attacker-controlled ONNX files beside a readable target and cause them to be loaded
Why this happens
The underlying flaw is insufficient validation and containment of user-controlled path components used in model filenames and download destinations. Path traversal permits filesystem locations to escape the intended directory, while unpinned downloads allow attacker-influenced model content to be retrieved and processed. This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, compounded by missing artifact integrity validation and unsafe processing of externally controlled ONNX graphs.
The underlying flaw is insufficient validation and containment of user-controlled path components used in model filenames and download destinations. Path traversal permits filesystem locations to escape the intended directory, while unpinned downloads allow attacker-influenced model content to be retrieved and processed. This maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, compounded by missing artifact integrity validation and unsafe processing of externally controlled ONNX graphs.
Potential impact
- Sensitive files readable by the Rembg process may be disclosed
- Returned image masks may encode contents of local files
- Malicious ONNX graphs may perform unintended computation
- Service availability or processing integrity may be affected
- Compromise of additional application data may occur if the service has excessive filesystem permissions
- Sensitive files readable by the Rembg process may be disclosed
- Returned image masks may encode contents of local files
- Malicious ONNX graphs may perform unintended computation
- Service availability or processing integrity may be affected
- Compromise of additional application data may occur if the service has excessive filesystem permissions
General mitigation guidance
Mitigation should reduce trust in model-selection inputs and enforce strict filesystem and artifact boundaries.
Common defensive patterns include:
- Allowlisting model identifiers instead of accepting arbitrary filenames or URLs
- Canonicalizing paths and enforcing containment within a dedicated, non-sensitive model directory
- Rejecting traversal components, separators, fragments, and unexpected encoding forms
- Using fixed, trusted download sources with cryptographic hash verification
- Separating downloaded artifacts from application data and readable host paths
- Running the service with a dedicated least-privilege account and minimal filesystem access
- Treating externally supplied ONNX models as untrusted and restricting their execution capabilities
- Applying resource, network, and output controls to the image-processing service
Mitigation should reduce trust in model-selection inputs and enforce strict filesystem and artifact boundaries.
Common defensive patterns include:
- Allowlisting model identifiers instead of accepting arbitrary filenames or URLs
- Canonicalizing paths and enforcing containment within a dedicated, non-sensitive model directory
- Rejecting traversal components, separators, fragments, and unexpected encoding forms
- Using fixed, trusted download sources with cryptographic hash verification
- Separating downloaded artifacts from application data and readable host paths
- Running the service with a dedicated least-privilege account and minimal filesystem access
- Treating externally supplied ONNX models as untrusted and restricting their execution capabilities
- Applying resource, network, and output controls to the image-processing service
How teams detect issues like this
Detection can focus on both input handling and model retrieval behavior:
- Static analysis for user-controlled values reaching filesystem joins, download paths, or model-loading APIs
- Code review checks for path normalization without a containment check
- Rules identifying unpinned artifact downloads and model loads from writable directories
- Web application monitoring for traversal markers, encoded separators, unusual URL fragments, and repeated model requests
- Filesystem monitoring for unexpected ONNX files created outside approved model directories
- Egress policies and integrity controls for downloads initiated by image-processing workers
- Automated security review tools can help identify tainted path and artifact-loading flows
Detection can focus on both input handling and model retrieval behavior:
- Static analysis for user-controlled values reaching filesystem joins, download paths, or model-loading APIs
- Code review checks for path normalization without a containment check
- Rules identifying unpinned artifact downloads and model loads from writable directories
- Web application monitoring for traversal markers, encoded separators, unusual URL fragments, and repeated model requests
- Filesystem monitoring for unexpected ONNX files created outside approved model directories
- Egress policies and integrity controls for downloads initiated by image-processing workers
- Automated security review tools can help identify tainted path and artifact-loading flows
