# Leon: a crafted model URL writes files outside the assistant's folder

> Leon's built-in model download command could write attacker-supplied files anywhere the assistant can write, fixed on 23 October 2026.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-25
- **CVE:** CVE-2026-116073
- **CVSS:** 6.9
- **Affects:** Leon
- **Research by:** George Chen
- **Primary source:** https://www.vulncheck.com/advisories/leon-before-commit-50df142-path-traversal-via-download-model-command
- **Page:** https://theinjection.dev/items/leon-download-model-path-traversal/

Leon's /download model command decoded percent-encoded separators after stripping the path, so a crafted link wrote files outside the models folder. VulnCheck published CVE-2026-116073 on 25 October, two days after the fix merged.

## What happened

A public issue in the leon-ai/leon repository on 17 October 2026 reported that Leon's /download model command could write files outside its models directory. A contributor reproduced the flaw on the develop branch the same day and opened a fix, which the maintainer merged on 23 October 2026. VulnCheck published CVE-2026-116073 for it on 25 October 2026 and credits George Chen.

## How it works

The download command built its destination name by calling path.basename() on the still-encoded URL path, then ran decodeURIComponent() on the result. Encoded separators such as %2f survived basename() and turned back into real separators afterwards, so the finished name escaped the models directory. Leon also created any missing parent directories, so the write could land on a path that did not exist before.

## Who is affected

Self-hosted Leon installs running the 2.0 Developer Preview on the develop branch are the exposed case, over the commit range listed below. Exploitation needs a user to run /download model with a URL the attacker supplied, so an operator who pastes links from other people is the realistic victim.

## What to do

Update Leon to commit 50df142 or later, since the fix is a merged commit on the develop branch rather than a tagged release. Until then do not pass URLs from other people to /download model, and check the models directory and its parents for files that arrived through a download.

## Quick facts

- **Affected:** leon from commit a3afdef81c8dd085b922f5a4e6b68bb9b9d802e4 up to, not including, 50df142a89a0859e5b7283d87afdab7b01e712a2
- **Fixed in:** Commit 50df142a89a0859e5b7283d87afdab7b01e712a2, merged 23 October 2026
- **CVE:** CVE-2026-116073
- **CVSS:** 6.9 (v4.0), Medium, assigned by VulnCheck
- **Attack type:** Path traversal to arbitrary file write, CWE-22
- **Found by:** George Chen, per VulnCheck, in issue 593
- **Disclosed:** Issue filed 17 October 2026, CVE published 25 October 2026

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/leon-before-commit-50df142-path-traversal-via-download-model-command)
2. [GitHub Issue 593](https://github.com/leon-ai/leon/issues/593)
3. [Fix Pull Request](https://github.com/leon-ai/leon/pull/594)
4. [Fix Commit](https://github.com/leon-ai/leon/commit/50df142a89a0859e5b7283d87afdab7b01e712a2)