GitHub Security Advisory: GHSA-3wqj-33cg-xc48
Package: rembg (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-73: External Control of File Name or Path
Vulnerable versions: < 2.0.75
Patched in: 2.0.75

Summary: Rembg has a Path Traversal via Custom Model Loading

Details:
## Summary

A **path traversal vulnerability** in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious `model_path` parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages.

**CWE IDs:** CWE-22 (Path Traversal), CWE-73 (External Control of File Name or Path)

---

## Details

### Vulnerable Code Flow

The vulnerability exists in how the HTTP server handles the `extras` JSON parameter for custom model types (`u2net_custom`, `dis_custom`, `ben_custom`).

**1. Entry Point** - [`rembg/commands/s_command.py`](https://github.com/danielgatis/rembg/blob/main/rembg/commands/s_command.py#L191-L202)

```python
def im_without_bg(content: bytes, commons: CommonQueryParams) -> Response:
    kwargs = {}
    if commons.extras:
        try:
            kwargs.update(json.loads(commons.extras))  # ❌ No validation
        except Exception:
            pass
    # ...
    session = new_session(commons.model, **kwargs)  # Passes arbitrary kwargs
```

The `extras` parameter is parsed as JSON and passed directly to `new_session()` without any validation.

**2. Path Handling** - [`rembg/sessions/u2net_custom.py`](https://github.com/danielgatis/rembg/blob/main/rembg/sessions/u2net_custom.py#L79-L83)

```python
@classmethod
def download_models(cls, *args, **kwargs):
    model_path = kwargs.get("model_path")
    if model_path is None:
        raise ValueError("model_path is required")
    return os.path.abspath(os.path.expanduser(model_path))  # ❌ No path validation
```

The `model_path` is returned with tilde expansion but no validation against path traversal.

**3. File Read** - [`rembg/sessions/base.py`](https://github.com/danielgatis/rembg/blob/main/rembg/sessions/base.py#L34-L38)

```python
self.inner_session = ort.InferenceSession(
    str(self.__class__.download_models(*args, **kwargs)),  # Reads file
    # ...
)
```

The path is passed to `onnxruntime.InferenceSession()` which attempts to read and parse the file.

### Root Cause

The custom model feature was designed for **CLI usage** where users already have local filesystem access. However, this feature is also exposed via the **HTTP API** without any restrictions, creating a security boundary violation.

---

## PoC

### Prerequisites

- Python 3.10+
- rembg installed with CLI support: `pip install "rembg[cpu,cli]"`

### Step 1: Start the Vulnerable Server

Open a terminal and run:

```bash
rembg s --host 0.0.0.0 --port 7000
```

You should see output like:
```
To access the API documentation, go to http://localhost:7000/api
To access the UI, go to http://localhost:7000
```

### Step 2: Send the Exploit Request

Open a **second terminal** and run this Python script:

```python
import requests
import json
import urllib.parse
from io import BytesIO

# Minimal valid 1x1 PNG image (requ