Threat database

Leon before commit 50df142 has a path traversal vulnerability in the getModelFileNameFromURL() function. This flaw allows attackers to write files outside the intended models directory by using percent-encoded '../' sequences in a crafted URL. Exploitation requires tricking a user into running a '/download model' command with the malicious URL. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.