AIKIDO-2026-608584

TL;DR

The SAM background-removal session reads the sam_model value from the public extras payload of the /api/remove endpoint and interpolates it directly into GitHub download URLs and local model filenames without validation. Because an HTTP client drops a URL #fragment while the local POSIX path keeps it, a crafted value such as sam_vit_b_01ec64#/../../../evil fetches the legitimate asset but writes it outside the model directory. An unauthenticated request can place a malicious ONNX graph next to a target file; the graph then reads that file as external tensor data and encodes its bytes into the returned mask, disclosing arbitrary files readable by the rembg process. The fix rejects any sam_model outside the three published SAM checkpoints before it reaches a path or URL and pins md5 digests for every SAM asset.