Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs

The public /api/remove endpoint uses attacker-controlled extras.sammodel in both SAM filenames and GitHub download URLs. Path traversal plus a URL fragment lets an unauthenticated attacker place malicious ONNX models beside a target file. The models read the file as ONNX external data and encode...