Executive brief
Fonoster is an open-source VoIP and telephony platform that includes a VoiceServer component for serving audio files. A directory traversal vulnerability allows attackers to read arbitrary files from the server by crafting specially-formed requests to the /sounds/:file and /tts/:file endpoints, potentially exposing sensitive configuration or data files without authentication.
Technical details
The vulnerability is a path traversal (CWE-24) in the serveFiles function of mods/voice/src/utils.ts in Fonoster versions 0.5.5 through 0.6.0. Attackers can use "../" sequences in the file parameter of the /sounds/:file or /tts/:file VoiceServer endpoints to escape the intended directory and read arbitrary files from the system. The attack requires only network reachability and no authentication. An attacker can achieve arbitrary file read, potentially exposing sensitive data or configuration secrets. The vulnerability was fixed in version 0.6.1, where the serveFiles function was removed.
Affected products
- Fonoster @fonoster/voice 0.5.5 through 0.6.0
Timeline
- 2026-03-05: disclosed: Vulnerability published
- 2026-03-06: patched: Fixed in version 0.6.1