Applio

Applio

14 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2025-27774

  • EPSS 0.18%
  • Published 19.03.2025 20:42:56
  • Last modified 01.08.2025 00:55:35

Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 156 in 3.2.7). The blind SSRF allows for sending requests on behalf of Applio server and can ...

5.3

CVE-2025-27775

  • EPSS 0.18%
  • Published 19.03.2025 20:42:47
  • Last modified 01.08.2025 00:50:07

Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 143 in 3.2.7). The blind SSRF allows for sending requests on behalf of Applio server and can ...

5.3

CVE-2025-27776

  • EPSS 0.17%
  • Published 19.03.2025 20:42:38
  • Last modified 01.08.2025 00:47:24

Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 240 in 3.2.7). The blind SSRF allows for sending requests on behalf of Applio server and can ...

7.5

CVE-2025-27777

  • EPSS 0.08%
  • Published 19.03.2025 20:42:29
  • Last modified 01.08.2025 00:42:36

Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) in `model_download.py` (line 195 in 3.2.7). The blind SSRF allows for sending requests on behalf of Applio server and can be leveraged to...

9.8

CVE-2025-27778

  • EPSS 2.44%
  • Published 19.03.2025 20:42:19
  • Last modified 01.08.2025 00:41:40

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `infer.py`. The issue can lead to remote code execution. As of time of publication, a fix is available on the `main` branch of the Applio r...

9.8

CVE-2025-27779

  • EPSS 2.51%
  • Published 19.03.2025 20:42:11
  • Last modified 01.08.2025 00:39:19

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `model_blender.py` lines 20 and 21. `model_fusion_a` and `model_fusion_b` from voice_blender.py take user-supplied input (e.g. a path to a ...

9.8

CVE-2025-27782

Exploit
  • EPSS 1.67%
  • Published 19.03.2025 20:41:51
  • Last modified 01.08.2025 16:31:08

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in inference.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserial...

9.8

CVE-2025-27783

  • EPSS 0.97%
  • Published 19.03.2025 20:41:41
  • Last modified 01.08.2025 16:26:57

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in train.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserializat...

7.5

CVE-2025-27784

Exploit
  • EPSS 0.08%
  • Published 19.03.2025 20:41:32
  • Last modified 01.08.2025 16:24:06

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_pth` function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with...

7.5

CVE-2025-27787

Exploit
  • EPSS 0.29%
  • Published 19.03.2025 20:41:09
  • Last modified 01.08.2025 16:03:19

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to denial of service (DoS) in restart.py. `model_name` in train.py takes user input, and passes it to the `stop_train` function in restart.py, which uses it construct a...