CVE-2025-27779

CVE-2025-27779 (Applio) : Affects Applio, versions 3.2.8-bugfix and prior. The issue is unsafe deserialization in the model_blender.py file (lines 20–21) triggered when user-supplied input (e.g., a model path) is passed through voice_blender.py’s model_fusion_a/b to run_model_blender_script and e...

CVE-2025-27779

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in "modelblender.py" lines 20 and 21. "modelfusiona" and "modelfusionb" from voiceblender.py take user-supplied input e.g. a path to a model and pass that value to the "runmodelblenderscrip...

CVE-2025-27779 Applio allows unsafe deserialization in model_blender.py

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in modelblender.py lines 20 and 21. modelfusiona and modelfusionb from voiceblender.py take user-supplied input e.g. a path to a model and pass that value to the runmodelblenderscript and...

CVE-2025-27782 Applio allows arbitrary file write in inference.py

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in inference.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. As of...

CVE-2025-27782

The CVE-2025-27782 entry concerns Applio, a voice-conversion tool. Affected are versions 3.2.8-bugfix and earlier, where the vulnerability exists in inference.py allowing arbitrary file write on the server. This can be combined with unsafe deserialization to achieve remote code execution. As of p...

CVE-2025-27782

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in inference.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. As of...

CVE-2025-27782 Applio allows arbitrary file write in inference.py

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in inference.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. As of...

CVE-2025-27783 Applio allows arbitrary file write in train.py

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in train.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. As of tim...

CVE-2025-27783 Applio allows arbitrary file write in train.py

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in train.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. As of tim...

CVE-2025-27783

The CVE-2025-27783 entry concerns Applio (voice conversion tool). Affected versions: 3.2.8-bugfix and prior. Root cause: arbitrary file write in train.py, which can write files on the Applio server and, when combined with unsafe deserialization, may enable remote code execution. As of publication...

CVE-2025-27783

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in train.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. As of tim...

CVE-2025-27783 Applio allows arbitrary file write in train.py

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in train.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to achieve remote code execution. As of tim...

CVE-2025-27784

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's "exportpth" function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files...

CVE-2025-27784 Applio allows arbitrary file read in train.py export_pth function

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's exportpth function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files...

CVE-2025-27784

Applio CVE-2025-27784 affects Applio voice conversion tool (versions 3.2.8-bugfix and prior). The issue is an arbitrary file read in train.py's export_pth function, allowing reading arbitrary server files. It can be chained with blind server-side request forgery (SSRF) to access files on internal...

CVE-2025-27784 Applio allows arbitrary file read in train.py export_pth function

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's exportpth function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files...

CVE-2025-27787

Applio (versions 3.2.8-bugfix and earlier) is affected by a DoS when restart.py executes. The train.py model_name parameter accepts user input and passes it to stop_train in restart.py, which constructs a path to a folder containing config.json. The config.json’s process_pids list is read and all...

CVE-2025-27787 Applio allows a DoS in restart.py

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to denial of service DoS in restart.py. modelname in train.py takes user input, and passes it to the stoptrain function in restart.py, which uses it construct a path to a folder with config.json. That config.json is...

CVE-2025-27787

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to denial of service DoS in restart.py. "modelname" in train.py takes user input, and passes it to the "stoptrain" function in restart.py, which uses it construct a path to a folder with "config.json". That...

CVE-2025-27787 Applio allows a DoS in restart.py

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to denial of service DoS in restart.py. modelname in train.py takes user input, and passes it to the stoptrain function in restart.py, which uses it construct a path to a folder with config.json. That config.json is...