CVE-2025-27785: Applio allows arbitrary file read in train.py export_index function
Description
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_index` function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files from servers on the internal network that the Applio server has access to. As of time of publication, no known patches are available.
Classification
CVE ID: CVE-2025-27785
CVSS Base Severity: HIGH
CVSS Base Score: 7.7
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Problem Types
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Affected Products
Vendor: IAHispano
Product: Applio
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.08% (probability of being exploited)
EPSS Percentile: 25.66% (scored less or equal to compared to others)
EPSS Date: 2025-04-17 (when was this score calculated)
Stakeholder-Specific Vulnerability Categorization (SSVC)
SSVC Exploitation: poc
SSVC Technical Impact: partial
SSVC Automatable: true
References
https://nvd.nist.gov/vuln/detail/CVE-2025-27785https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/
https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L273
https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L816