CVE-2024-43035

🗓️ 05 Mar 2026 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 194 Views🌐 WEB

CVE 2024-43035 allows traversal to read files via voice endpoints in Fonoster before 0.6.1.

Reporter	Title	Published	Views	Family All 18
GithubExploit	Exploit for CVE-2024-43035	21 Aug 202421:12	–	githubexploit
attackerkb	CVE-2024-43035	5 Mar 202600:00	–	attackerkb
Circl	CVE-2024-43035	23 Aug 202421:49	–	circl
CNNVD	Fonoster security vulnerabilities	5 Mar 202600:00	–	cnnvd
Cvelist	CVE-2024-43035	5 Mar 202600:00	–	cvelist
EUVD	EUVD-2024-55468	5 Mar 202621:30	–	euvd
Github Security Blog	Fonoster is vulnerable to directory traversal	5 Mar 202621:30	–	github
Kitploit	Fonoster-LFI-PoC	28 Oct 202609:51	–	kitploit
Mend	CVE-2024-43035	5 Mar 202600:00	–	mend
NVD	CVE-2024-43035	5 Mar 202620:16	–	nvd

Vulners

Node

fonoster fonosterRange0.5.5–0.6.1

[
  {
    "defaultStatus": "unknown",
    "product": "Fonoster",
    "vendor": "Fonoster",
    "versions": [
      {
        "lessThan": "0.6.1",
        "status": "affected",
        "version": "0.5.5",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
zeropath	www.zeropath.com/blog/fonoster-voiceserver-lfi-vulnerability
github	www.github.com/fonoster/fonoster/blob/4a1438d9dedeaf7b2a5b6a50d5e233f994e2b2cf/mods/voice/src/utils.ts

Parameter	Position	Path	Description	CWE
:file	path	/sounds/:file	Directory traversal in the /sounds/:file endpoint allows reading arbitrary files from the server.	CWE-24
:file	path	/tts/:file	Directory traversal in the /tts/:file endpoint allows reading arbitrary files from the server.	CWE-24

17 Jun 2026 07:50Current

8.5High risk

Vulners AI Score8.5

CVSS 3.15.8

EPSS0.02507

SSVC

CWE-24