PT-2026-24699 · Wanderingastronomer · Vociferous

Cfarley05 · Publicado 2026-03-11 · Atualizado 2026-03-15 · CVE-2026-27897

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vociferous versions prior to 4.4.2

Description Vociferous is a cross-platform, offline speech-to-text application with local AI refinement. A flaw exists in the src/api/system.py file within the /export file API endpoint. The application accepts a JSON payload containing a filename and content, but does not validate the filename string before processing it with the backend filesystem logic. The API is unauthenticated and the CORS configuration allows requests from any origin. This allows an attacker to bypass the user interface and use directory traversal sequences (e.g., '../') to write arbitrary data to any location accessible by the current user's permissions. The vulnerable component is the /export file API endpoint, which accepts a filename variable in the JSON payload.

Recommendations Update Vociferous to version 4.4.2 or later.

Correção

RCE

Path traversal

Missing Authentication

Enumeração de Fraquezas

CWE-22

CWE-306

Identificadores relacionados

CVE-2026-27897

Produtos afetados

Vociferous

Referências · 7

• https://github.com/WanderingAstronomer/Vociferous/security/advisories/GHSA-7cpr-frgj-h85v · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-27897 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2031766569702015207 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2031760653896032293 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2032999254889799686 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2031772558505218339 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2032998330574270563 · Publicação no Twitter