{"id":"CVE-2026-116073","kind":"vulnerability","aliases":["CVE-2026-116073"],"related":[],"title":"Leon: model download path traversal lets a URL write files outside models directory","description":"Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../' sequences to write attacker-controlled content to arbitrary paths writable by Leon.","summary":"Leon, an open-source personal AI assistant, has a path traversal flaw in getModelFileNameFromURL() where percent-encoded separators in a model URL escape the models directory. An attacker who tricks a user into running '/download model' with a crafted URL can write attacker-controlled content to arbitrary paths Leon can write to.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-assistant","ai-tooling","leon","self-hosted"],"not_affected_if":["default-config","fixed-commit"],"how_to_check":"- Check whether the installed Leon is older than commit `50df142`, using `git log --oneline | grep 50df142` in the Leon checkout\n- Review whether `/download model` is used with URLs from untrusted sources\n- unknown for other checks, the sources do not say","fix":"- Update Leon to a commit at or after `50df142`\n- unknown for other mitigations, the sources do not say","status":"open","published_at":"2026-10-25T12:16:29+00:00","first_seen_at":"2026-10-25T12:40:44+00:00","triaged_at":"2026-10-25T12:41:28+00:00","updated_at":"2026-10-25T12:41:28+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T12:41:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update Leon to a commit at or after `50df142`\n- unknown for other mitigations, the sources do not say","reach":"local","title":"Leon: model download path traversal lets a URL write files outside models directory","impact":"medium","summary":"Leon, an open-source personal AI assistant, has a path traversal flaw in getModelFileNameFromURL() where percent-encoded separators in a model URL escape the models directory. An attacker who tricks a user into running '/download model' with a crafted URL can write attacker-controlled content to arbitrary paths Leon can write to.","category":"ai-tooling","nicknames":[],"who_cares":["leon","self-hosted","ai-assistant"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker writes arbitrary content to paths Leon can write to","analyst_note":"Confirm the affected version range and whether the trigger is reachable remotely; NVD entry only, no vendor advisory linked.","how_to_check":"- Check whether the installed Leon is older than commit `50df142`, using `git log --oneline | grep 50df142` in the Leon checkout\n- Review whether `/download model` is used with URLs from untrusted sources\n- unknown for other checks, the sources do not say","needs_analyst":true,"not_affected_if":["default-config","fixed-commit"],"who_is_affected":"Teams running Leon before commit `50df142` where users can run '/download model' with URLs they did not vet. The exposure depends on the user being tricked into running the command, and on what Leon's process can write to. Installations at or after the fixed commit, or those that never use the model download command, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000635,"input_tokens":3340,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116073':16A,19A '-2026':15A,18A '/download':66B,117C '50df142':87C 'ai':21B,24B,36B 'ai-assist':20B 'ai-tool':23B 'allow':96C 'arbitrari':79B,133C 'assist':22B,37B 'attack':59B,75B,97C,110C,129C 'attacker-control':74B,128C 'commit':86C 'contain':88C,123C 'content':77B,131C 'control':76B,130C 'craft':70B,121C 'cve':14A,17A 'directori':13A,57B,104C 'download':3A 'encod':48B,108C,124C 'escap':54B 'file':10A,100C 'flaw':42B 'getmodelfilenamefromurl':44B,94C 'host':29B 'leon':1A,26B,30B,81B,84C,137C 'let':6A 'model':2A,12A,52B,56B,67B,103C,118C 'open':33B 'open-sourc':32B 'outsid':11A,101C 'path':4A,40B,80B,90C,134C 'percent':47B,107C 'percent-encod':46B,106C 'person':35B 'run':65B,116C 'self':28B 'self-host':27B 'separ':49B,109C 'sequenc':125C 'sourc':34B 'tool':25B 'travers':5A,41B,91C 'trick':61B,112C 'url':8A,53B,71B,122C 'user':63B,114C 'via':105C 'vulner':92C 'writabl':135C 'write':9A,73B,83B,99C,127C","nicknames":[],"mitigations":[],"who_affected":"Teams running Leon before commit `50df142` where users can run '/download model' with URLs they did not vet. The exposure depends on the user being tricked into running the command, and on what Leon's process can write to. Installations at or after the fixed commit, or those that never use the model download command, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T12:16:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116073","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116073","severity":null,"published_at":"2026-10-25T12:16:29+00:00","modified_at":"2026-10-25T12:16:29+00:00","first_seen_at":"2026-10-25T12:40:44+00:00","fetched_at":"2026-10-25T12:40:44+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}