PT-2025-11976 · Applio · Applio

Published 2025-03-19 · Updated 2025-08-01 · CVE-2025-27774

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Applio versions 3.2.7 and prior

Description Applio is a voice conversion tool. It is susceptible to server-side request forgery (SSRF) and file write vulnerabilities in model download.py (line 156 in version 3.2.7). The blind SSRF allows sending requests on behalf of the Applio server, potentially enabling the discovery of other vulnerabilities on the server or back-end systems within the internal network accessible to Applio. This SSRF can be combined with arbitrary file read capabilities to read files from hosts on the internal network, resulting in a full SSRF. The file write vulnerability allows writing files on the server, which, in conjunction with other vulnerabilities like unsafe deserialization, could lead to remote code execution on the Applio server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-27774

Affected Products

Applio

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27774.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27774 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27774 · Vendor Advisory
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/download/download.py#L192-L196 · Note
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/rvc/lib/tools/model_download.py#L147-L148 · Note
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/rvc/lib/tools/model_download.py#L143 · Note
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/assets/flask/routes.py#L14 · Note
• https://t.me/cveNotify/130479 · Telegram Post
• https://t.me/cvedetector/20682 · Telegram Post
• https://twitter.com/CVEnew/status/1902462694961377402 · Twitter Post
• https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio · Note
• https://t.me/cvetracker/19479 · Telegram Post
• https://twitter.com/CveFindCom/status/1902465880652468230 · Twitter Post