QwikSec

Security Database

CVE

CWE

Training

CVE-2025-27783

Published: Mar 19, 2025

Modified: Mar 20, 2025

PUBLISHED

Description

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in train.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. As of time of publication, no known patches are available.

Vendor	Product	Versions
IAHispano	Applio	affected `<= 3.2.8-bugfix`

Weaknesses (CWE)

References

https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/

x_refsource_CONFIRM

https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L212-L225

x_refsource_MISC

https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L484-L491

x_refsource_MISC

https://github.com/IAHispano/Applio/blob/d7d685fefd0c58e29e1d84d668613056791544a7/tabs/inference/inference.py#L295

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.