CVE-2024-43035

MEDIUM

Fonoster 0.5.5 - Path Traversal

Title source: llm

Description

Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.

Exploits (1)

nomisec WORKING POC

by ZeroPathAI · poc

https://github.com/ZeroPathAI/Fonoster-LFI-PoC

View Code ZIP pw:eip

References (2)

[Third Party Advisory] https://github.com/fonoster/fonoster/blob/4a1438d9dedeaf7b2a5b6a50d5e233f994e2b2cf/mods/voice/src/utils.ts#L66-L70

View Writeup ZIP pw:eip

[Various Sources] https://zeropath.com/blog/fonoster-voiceserver-lfi-vulnerability

Scores

CVSS v3 5.8

EPSS 0.0041

EPSS Percentile 61.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-24

Status published

Products (2)

Fonoster/Fonoster 0.5.5 - 0.6.1

fonoster/voice 0.5.5 - 0.6.1npm

Published Mar 05, 2026

Tracked Since Mar 06, 2026