PT-2025-11964 · Applio+1 · Applio+1

Sylwia Budzynska + 1 · Published 2025-03-19 · Updated 2025-08-01 · CVE-2025-27780

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Applio versions 3.2.8-bugfix and prior

Description Applio is a voice conversion tool vulnerable to unsafe deserialization in the model information.py file. The model name variable in model information.py accepts user-supplied input, such as a path to a model, and passes this value to the run model information script and subsequently to the model information function. This function loads the model using torch.load (located on line 16 in version 3.2.8-bugfix), which is susceptible to unsafe deserialization. This issue can potentially lead to remote code execution.

Recommendations Applio versions prior to 3.2.8-bugfix: Update to the latest version or apply the patch available in the main branch of the repository.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-27780

Affected Products

Applio

Torch

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27780.json · Exploit
• https://github.com/IAHispano/Applio/commit/11d139508d615a6db4d48b76634a443c66170dda · Patch
• https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27780 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27780 · Vendor Advisory
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/rvc/train/process/model_information.py#L16 · Note
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/extra/model_information.py#L11-L16 · Note
• https://t.me/cvetracker/19485 · Telegram Post
• https://t.me/cveNotify/130567 · Telegram Post
• https://twitter.com/SecAideInfo/status/1903389700481810558 · Twitter Post
• https://twitter.com/CveFindCom/status/1902458212630036598 · Twitter Post
• https://twitter.com/CVEnew/status/1902462708043411925 · Twitter Post
• https://t.me/latest_high_impact_cve/2003 · Telegram Post
• https://t.me/cvedetector/20681 · Telegram Post