CVE-2025-25301mediumCWE-918

CVE-2025-25301: medium-severity vulnerability in danielgatis rembg

Rembg allows SSRF via /api/remove

Published

Follow this CVE+ Monitor rembg+ Monitor rembg

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.5%
Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the /api/remove endpoint takes a URL query parameter that allows an image to be fetched, processed and returned. An attacker may be able to query this endpoint to view pictures hosted on the internal network of the rembg server. This issue may lead to Information Disclosure.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
danielgatis · rembg
Related CVEs — danielgatis rembg

In the same product, most dangerous first.

CVE-2026-40086MEDIUMRembg has a Path Traversal via Custom Model LoadingEPSS 0.6%CVE-2026-115924HIGHRembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphsEPSS 0.4%CVE-2025-25302HIGHRembg CORS misconfigurationEPSS 0.2%