PT-2025-11986 · Applio · Applio

Sylwia Budzynska + 1 · Published 2025-03-19 · Updated 2025-03-20 · CVE-2025-27786

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Applio versions 3.2.8-bugfix and prior

Description The issue concerns arbitrary file removal in the core.py component. The output tts path variable in tts.py accepts arbitrary user input, which is then passed to the run tts script function in core.py. This function checks if the path specified in output tts path exists and, if it does, proceeds to remove that path, resulting in arbitrary file removal. There are no known patches available as of the time of publication.

Recommendations For versions 3.2.8-bugfix and prior, consider disabling the run tts script function in core.py as a temporary workaround until a patch is available. Restrict access to the output tts path variable in tts.py to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-27786

Affected Products

Applio

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27786.json · Exploit
• https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27786 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27786 · Security Note
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/core.py#L329 · Note
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/tts/tts.py#L133 · Note
• https://twitter.com/CVEnew/status/1902462705346474046 · Twitter Post
• https://t.me/cvedetector/20676 · Telegram Post
• https://t.me/latest_high_impact_cve/2004 · Telegram Post
• https://t.me/cvetracker/19491 · Telegram Post