PT-2025-11977 · Applio · Applio

Published 2025-03-19 · Updated 2025-08-01 · CVE-2025-27775

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Applio versions 3.2.7 and prior

Description Applio is a voice conversion tool vulnerable to server-side request forgery (SSRF) and file write within the model download.py file (line 143 in version 3.2.7). The SSRF allows sending requests on behalf of the Applio server, potentially enabling probing for other vulnerabilities on the server or internal network systems accessible to the Applio server. The file write capability allows writing files on the server, which, in conjunction with other vulnerabilities like unsafe deserialization, could lead to remote code execution on the Applio server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-27775

Affected Products

Applio

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27775.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27775 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27775 · Vendor Advisory
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/rvc/lib/tools/model_download.py#L169-L171 · Note
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/rvc/lib/tools/model_download.py#L156 · Note
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/assets/flask/routes.py#L14 · Note
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/download/download.py#L192-L196 · Note
• https://t.me/cveNotify/130480 · Telegram Post
• https://twitter.com/CveFindCom/status/1902465804895187229 · Twitter Post
• https://twitter.com/CVEnew/status/1902462695921897757 · Twitter Post
• https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio · Note
• https://t.me/cvetracker/19480 · Telegram Post
• https://t.me/cvedetector/20677 · Telegram Post