PT-2026-24699 · Wanderingastronomer · Vociferous

Cfarley05 · Published 2026-03-11 · Updated 2026-03-15 · CVE-2026-27897

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vociferous versions prior to 4.4.2

Description Vociferous is a cross-platform, offline speech-to-text application with local AI refinement. A flaw exists in the src/api/system.py file within the /export file API endpoint. The application accepts a JSON payload containing a filename and content, but does not validate the filename string before processing it with the backend filesystem logic. The API is unauthenticated and the CORS configuration allows requests from any origin. This allows an attacker to bypass the user interface and use directory traversal sequences (e.g., '../') to write arbitrary data to any location accessible by the current user's permissions. The vulnerable component is the /export file API endpoint, which accepts a filename variable in the JSON payload.

Recommendations Update Vociferous to version 4.4.2 or later.

Fix

RCE

Path traversal

Missing Authentication

Weakness Enumeration

CWE-22

CWE-306

Related Identifiers

CVE-2026-27897

Affected Products

Vociferous

References · 7

• https://github.com/WanderingAstronomer/Vociferous/security/advisories/GHSA-7cpr-frgj-h85v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27897 · Security Note
• https://twitter.com/TheHackerWire/status/2031766569702015207 · Twitter Post
• https://twitter.com/0dayPublishing/status/2031760653896032293 · Twitter Post
• https://twitter.com/infoflowcloud/status/2032999254889799686 · Twitter Post
• https://twitter.com/CveFindCom/status/2031772558505218339 · Twitter Post
• https://twitter.com/CVEnew/status/2032998330574270563 · Twitter Post