CVE-2026-8755CWE-22

fishaudio Bert-VITS2 Model hiyoriUI.py _get_all_models path traversal

Medium · published May 17, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
53.4
In the wild
Unconfirmed
What it is

A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is the function _get_all_models of the file hiyoriUI.py of the component Model Handler. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00718 · 53.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-17T12:45Z
EPSS history
Timeline
  • 17 MAY 12:45Z
    fishaudio Bert-VITS2 Model hiyoriUI.py _get_all_models path traversal
    cvelistv5