CVE catalog

CVE-2026-40086

Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's

[CVE catalog]

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: Apr 10, 2026, 5:17:12 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.59% · Oct 25, 2026

Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious model_path parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages. This vulnerability is fixed in 2.0.75.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Cpe	rembg	Not reported	`2.0.75`	fixed
PyPI	rembg	Not reported	`2.0.75`	fixed
Cpe	rembg	Not reported	`2.0.75`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Cpe	rembg	cpe	Not reported	`2.0.75`	Not reported	Not reported	Not reported
PyPI	rembg	PyPI	Not reported	`2.0.75`	Not reported	PYSEC-2026-2274	Not reported
Cpe	rembg	cpe	Not reported	`2.0.75`	Not reported	NVD-CVE-2026-40086	Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 26, 2026, 10:27:07 PM UTC

References

[FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]