Leon: a crafted model URL writes files outside the assistant's folder
Leon's built-in model download command could write attacker-supplied files anywhere the assistant can write, fixed on 23 October 2026.
· VulnCheck · Research by George Chen
Leon's /download model command decoded percent-encoded separators after stripping the path, so a crafted link wrote files outside the models folder. VulnCheck published CVE-2026-116073 on 25 October, two days after the fix merged.
01What happened
A public issue in the leon-ai/leon repository on 17 October 2026 reported that Leon's /download model command could write files outside its models directory. A contributor reproduced the flaw on the develop branch the same day and opened a fix, which the maintainer merged on 23 October 2026. VulnCheck published CVE-2026-116073 for it on 25 October 2026 and credits George Chen.
02How it works
The download command built its destination name by calling path.basename() on the still-encoded URL path, then ran decodeURIComponent() on the result. Encoded separators such as %2f survived basename() and turned back into real separators afterwards, so the finished name escaped the models directory. Leon also created any missing parent directories, so the write could land on a path that did not exist before.
03Who is affected
Self-hosted Leon installs running the 2.0 Developer Preview on the develop branch are the exposed case, over the commit range listed below. Exploitation needs a user to run /download model with a URL the attacker supplied, so an operator who pastes links from other people is the realistic victim.
04What to do
Update Leon to commit 50df142 or later, since the fix is a merged commit on the develop branch rather than a tagged release. Until then do not pass URLs from other people to /download model, and check the models directory and its parents for files that arrived through a download.
Sources 4 links, all fetched
- 1vulncheck.comVulnCheck Advisory
- 2github.comGitHub Issue 593
- 3github.comFix Pull Request
- 4github.comFix Commit