HighVulnerability
CVE-2026-8756: fishaudio Bert-VITS2 path traversal in generate_config via data_dir
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-8756
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
A vulnerability in fishaudio Bert-VITS2 up to commit 8f7fbd8c4770965225d258db548da27dc8dd934c affects the generate_config function in webui_preprocess.py, part of the Gradio Interface component. Manipulating the data_dir argument leads to path traversal, and the attack can be launched remotely. The exploit is public and may be used, and the vendor did not respond after early contact.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
- CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
- MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
- HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySimilar attack · NVD/CVE Database
- InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek