PT-2025-11982 · Applio · Applio

Sylwia Budzynska + 1 · Publicado 2025-03-19 · Atualizado 2025-08-01 · CVE-2025-27782

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Applio versions 3.2.8-bugfix and prior

Description The issue affects a voice conversion tool and may lead to writing arbitrary files on the server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. The vulnerable component is the inference.py file.

Recommendations For versions 3.2.8-bugfix and prior, as a temporary workaround, consider restricting access to the inference.py file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2025-27782

Produtos afetados

Applio

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27782.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio · Exploit
• https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/tts/tts.py#L309-L322 · Nota
• https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/inference/inference.py#L1632-L1645 · Nota
• https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/inference/inference.py#L295 · Nota
• https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/inference/inference.py#L989-L1002 · Nota
• https://twitter.com/CVEnew/status/1902462700384559605 · Publicação no Twitter
• https://t.me/cveNotify/130569 · Publicação no Telegram
• https://t.me/cvetracker/19487 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-27782 · Nota de Segurança
• https://t.me/latest_high_impact_cve/2005 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-27782 · Aviso do Fabricante
• https://t.me/cvedetector/20672 · Publicação no Telegram