Live › vulnerability › CVE-2026-116073
Go to dashboardLeon, an open-source personal AI assistant, has a path traversal flaw in getModelFileNameFromURL() where percent-encoded separators in a model URL escape the models directory. An attacker who tricks a user into running '/download model' with a crafted URL can write attacker-controlled content to arbitrary paths Leon can write to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 12:40 UTC. All times on this page are UTC.
Teams running Leon before commit where users can run '/download model' with URLs they did not vet. The exposure depends on the user being tricked into running the command, and on what Leon's process can write to. Installations at or after the fixed commit, or those that never use the model download command, can skip it.
50df142No product ranges from the sources yet.
50df142, using git log --oneline | grep 50df142 in the Leon checkout/download model is used with URLs from untrusted sources50df142Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../' sequences to write attacker-controlled content to arbitrary paths writable by Leon.
This page as .md · .json · in your agent: get_signal("CVE-2026-116073")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.