CVE-2025-25302highCWE-346

CVE-2025-25302: falha de alta gravidade em danielgatis rembg

Rembg CORS misconfiguration

Publicada em

Seguir esta CVE+ Monitorar rembg+ Monitorar rembg

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.2%
Rembg is a tool to remove images background. In Rembg 2.0.57 and earlier, the CORS middleware is setup incorrectly. All origins are reflected, which allows any website to send cross site requests to the rembg server and thus query any API. Even if authentication were to be enabled, allow_credentials is set to True, which would allow any website to send authenticated cross site requests.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
danielgatis · rembg
CVEs relacionadas — danielgatis rembg

No mesmo produto, das mais perigosas para as menos.

CVE-2026-40086MEDIUMRembg has a Path Traversal via Custom Model LoadingEPSS 0.6%CVE-2025-25301MEDIUMRembg allows SSRF via /api/removeEPSS 0.5%CVE-2026-115924HIGHRembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphsEPSS 0.4%