{"schema":"threatline.record/2","record":{"id":"CVE-2026-116073","aliases":[],"summary":"Leon before commit 50df142 Path Traversal via /download model Command","details":"Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../' sequences to write attacker-controlled content to arbitrary paths writable by Leon.","categories":["Unclassified"],"product":"leon","vendor":"leon-ai","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116073","source_modified_at":"2026-10-25T11:51:00.624Z","fetched_at":"2026-10-25T16:01:37.004770Z","product":"leon","vendor":"leon-ai","versions":[{"version":"a3afdef81c8dd085b922f5a4e6b68bb9b9d802e4","status":"affected","versionType":"git","lessThan":"50df142a89a0859e5b7283d87afdab7b01e712a2"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116073","source_modified_at":"2026-10-25T11:51:00.624Z","fetched_at":"2026-10-25T16:01:37.004770Z","package":{"name":"leon","ecosystem":null},"version":"50df142a89a0859e5b7283d87afdab7b01e712a2","basis":"first unaffected version stated in the CVE record"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-25T11:51:00.624Z","modified_at":"2026-10-25T11:51:00.624Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116073","fetched_at":"2026-10-25T16:01:37.004770Z","source_modified_at":"2026-10-25T11:51:00.624Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/leon-ai/leon/issues/593","tags":["issue-tracking"]},{"source":"CVE List","url":"https://github.com/leon-ai/leon","tags":["product"]},{"source":"CVE List","url":"https://github.com/leon-ai/leon/blob/21baf11714f618a9367f25882e59e856d3308037/server/src/built-in-command/commands/download-command/download-command.ts#L21-L28","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/leon-ai/leon/pull/594","tags":["patch","issue-tracking"]},{"source":"CVE List","url":"https://github.com/leon-ai/leon/commit/50df142a89a0859e5b7283d87afdab7b01e712a2","tags":["patch"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/leon-before-commit-50df142-path-traversal-via-download-model-command","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-25T11:51:00.624Z","content_hash":"428fc3a6a006d4e1d86bc8b72d6d74140a7502e02387ec645e8156a23c43aeac"}}