CVE-2026-40086

Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious model_path parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages. This vulnerability is fixed in 2.0.75.

• CWE-22
• CWE-73

• https://github.com/danielgatis/rembg/commit/7c76d3cdc5757ffbda6a76664b24cfbecdb80273Patch
• https://github.com/danielgatis/rembg/releases/tag/v2.0.75Product, Release Notes
• https://github.com/danielgatis/rembg/security/advisories/GHSA-3wqj-33cg-xc48Exploit, Mitigation, Vendor Advisory

Published

Apr 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40079Cacti is an open source performance and fault management fra…9.8
• CVE-2026-4008A flaw has been found in Tenda W3 1.0.0.3(2204). This issue …8.8
• CVE-2026-40080Cacti is an open source performance and fault management fra…6.1
• CVE-2026-40082Cacti is an open source performance and fault management fra…5.4
• CVE-2026-40083Cacti is an open source performance and fault management fra…7.2
• CVE-2026-40084Cacti is an open source performance and fault management fra…6.5
• CVE-2026-40087LangChain is a framework for building agents and LLM-powered…5.3
• CVE-2026-40088PraisonAI is a multi-agent teams system. Prior to 4.5.121, t…9.6
• CVE-2026-40089Sonicverse is a Self-hosted Docker Compose stack for live ra…9.9
• CVE-2026-4009A vulnerability has been found in jarikomppa soloud up to 20…3.3
• CVE-2026-40090Zarf is an Airgap Native Packager Manager for Kubernetes. Ve…7.1
• CVE-2026-40091SpiceDB is an open source database system for creating and m…4.4