---
id: "CVE-2026-116073"
kind: "vulnerability"
aliases: ["CVE-2026-116073"]
title: "Leon: model download path traversal lets a URL write files outside models directory"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-assistant", "ai-tooling", "leon", "self-hosted"]
not_affected_if: ["default-config", "fixed-commit"]
published_at: "2026-10-25T12:16:29+00:00"
first_seen_at: "2026-10-25T12:40:44+00:00"
updated_at: "2026-10-25T12:41:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116073", "first_seen_at": "2026-10-25T12:40:44+00:00"}]
---

# Leon: model download path traversal lets a URL write files outside models directory

Leon, an open-source personal AI assistant, has a path traversal flaw in getModelFileNameFromURL() where percent-encoded separators in a model URL escape the models directory. An attacker who tricks a user into running '/download model' with a crafted URL can write attacker-controlled content to arbitrary paths Leon can write to.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the installed Leon is older than commit `50df142`, using `git log --oneline | grep 50df142` in the Leon checkout
- Review whether `/download model` is used with URLs from untrusted sources
- unknown for other checks, the sources do not say

## Fix

- Update Leon to a commit at or after `50df142`
- unknown for other mitigations, the sources do not say

## Timeline

- 2026-10-25T12:40:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116073

## From the sources

Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../' sequences to write attacker-controlled content to arbitrary paths writable by Leon.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_