PT-2025-11982 · Applio · Applio

Sylwia Budzynska + 1 · Published 2025-03-19 · Updated 2025-08-01 · CVE-2025-27782

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Applio versions 3.2.8-bugfix and prior

Description The issue affects a voice conversion tool and may lead to writing arbitrary files on the server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. The vulnerable component is the inference.py file.

Recommendations For versions 3.2.8-bugfix and prior, as a temporary workaround, consider restricting access to the inference.py file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-27782

Affected Products

Applio

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27782.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27782 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27782 · Vendor Advisory
• https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/tts/tts.py#L309-L322 · Note
• https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/inference/inference.py#L1632-L1645 · Note
• https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/inference/inference.py#L295 · Note
• https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/inference/inference.py#L989-L1002 · Note
• https://twitter.com/CVEnew/status/1902462700384559605 · Twitter Post
• https://t.me/cveNotify/130569 · Telegram Post
• https://t.me/cvetracker/19487 · Telegram Post
• https://t.me/latest_high_impact_cve/2005 · Telegram Post
• https://t.me/cvedetector/20672 · Telegram Post