Executive brief
Bert-VITS2 is an open-source text-to-speech tool used for voice synthesis. A security flaw in its web interface allows remote attackers to browse the server's file system and access files without any login credentials. This could lead to the exposure of sensitive training data, system configuration details, or a disruption of service.
Technical details
Multiple endpoints in hiyoriUI.py (including /models/get_local, /tools/get_audio, and /tools/random_example) fail to sanitize user-provided path parameters before passing them to sensitive Python functions like os.listdir(), os.path.isfile(), and os.walk(). Because the FastAPI server binds to 0.0.0.0 by default without authentication, a remote attacker can use these endpoints as a 'file existence oracle' to map the host filesystem. Specifically, the _get_all_models function allows directory enumeration, while the get_audio endpoint allows reading any .wav file on the system. Additionally, triggering recursive directory walks via the root_dir parameter can lead to resource exhaustion and Denial of Service (DoS).
Affected products
- fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c
Timeline
- 2026-03-21: disclosed: Initial discovery and Gist publication
- 2026-05-17: advisory: CVE published via VulDB/NVD