CVE-2026-8755

HIGH

fishaudio Bert-VITS2 Model hiyoriUI.py _get_all_models path traversal

Title source: cna

Description

A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is the function _get_all_models of the file hiyoriUI.py of the component Model Handler. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-364382 | fishaudio Bert-VITS2 Model hiyoriUI.py _get_all_models path traversal

https://vuldb.com/vuln/364382

Signature, Permissions Required signature permissions-required

VDB-364382 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/364382/cti

Third Party Advisory third-party-advisory

Submit #811173 | fishaudio Bert-VITS2 latest (commit 724d0b2) Path Traversal (CWE-22)

https://vuldb.com/submit/811173

Exploit exploit

https://gist.github.com/YLChen-007/99859f4f836cca523a5982645e7fdd97

Scores

CVSS v3 7.3

EPSS 0.0003

EPSS Percentile 8.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-22

Status published

Products (1)

fishaudio/Bert-VITS2 8f7fbd8c4770965225d258db548da27dc8dd934c

Published May 17, 2026

Tracked Since May 17, 2026