PT-2026-41567 · Fishaudio · Bert-Vits2

Eric-B · Published 2026-05-17 · Updated 2026-05-18 · CVE-2026-8756

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions fishaudio Bert-VITS2 versions up to 8f7fbd8c4770965225d258db548da27dc8dd934c

Description A path traversal issue exists in the Gradio Interface component. A remote attacker can manipulate the data dir argument within the generate config() function of the webui preprocess.py file to access files and directories outside the intended folder.

Recommendations Update fishaudio Bert-VITS2 to a version later than 8f7fbd8c4770965225d258db548da27dc8dd934c. As a temporary workaround, restrict access to the generate config() function in webui preprocess.py to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-8756

Affected Products

Bert-Vits2

References · 7

• 🔥 https://gist.github.com/YLChen-007/550cb92f3489c317ff049fc7d7ea6b99 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8756 · Security Note
• https://twitter.com/CVEnew/status/2056253270641750397 · Twitter Post
• https://vuldb.com/vuln/364383 · Note
• https://vuldb.com/submit/811175 · Note
• https://t.me/CVEtracker/54068 · Telegram Post
• https://vuldb.com/vuln/364383/cti · Note