PT-2025-11979 · Applio · Applio

Published 2025-03-19 · Updated 2025-08-01 · CVE-2025-27777

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Applio versions 3.2.7 and prior

Description Applio is a voice conversion tool. The issue allows for server-side request forgery (SSRF) in model download.py, which can be leveraged to probe for other vulnerabilities on the server itself or on other back-end systems on the internal network. The blind SSRF can also be coupled with an arbitrary file read to read files from hosts on the internal network.

Recommendations For versions 3.2.7 and prior, as a temporary workaround, consider disabling the model download.py function until a patch is available. Restrict access to the vulnerable model download.py module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-27777

Affected Products

Applio

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27777.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27777 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27777 · Vendor Advisory
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/assets/flask/routes.py#L14 · Note
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/rvc/lib/tools/model_download.py#L195 · Note
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/download/download.py#L192-L196 · Note
• https://github.com/IAHispano/Applio · Note
• https://twitter.com/CVEnew/status/1902462697767325706 · Twitter Post
• https://t.me/latest_high_impact_cve/2006 · Telegram Post
• https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio · Note
• https://t.me/cveNotify/130482 · Telegram Post
• https://t.me/cvedetector/20678 · Telegram Post
• https://t.me/cvetracker/19482 · Telegram Post