leon-ai CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM leon-ai CVE published 2026-10-25

CVE-2026-116073

CVE-2026-116073 is a path traversal vulnerability in the getModelFileNameFromURL() function of Leon before commit 50df142. This vulnerability allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running the '/download model' command with a crafted URL containing encoded '../' sequences to write attacker-controlled content to arbitrary [truncated]