ByteOS Network

NVD Vulnerability Details :

CVE-2025-27785

Analyzed

Source-security-advisories@github.com

Published At-19 Mar, 2025 | 21:15

Updated At-01 Aug, 2025 | 16:19

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_index` function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files from servers on the internal network that the Applio server has access to. As of time of publication, no known patches are available.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	7.7	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CPE Matches

applio>>applio>>Versions up to 3.2.8-bugfix(inclusive)

cpe:2.3:a:applio:applio:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-22	Primary	security-advisories@github.com
CWE-200	Primary	security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L273	security-advisories@github.com	Product
https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L816	security-advisories@github.com	Product
https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/	security-advisories@github.com	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History