Vulnerability · Published Mar 19, 2025 · Assigned by GitHub_M

CVE-2025-27785Applio allows arbitrary file read in train.py export_index function

High 7.7

In plain English

A high-severity information exposure in Applio from IAHispano. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 4.0)7.7High

Exploit odds (30 days)0.6%top 53.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_index` function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files from servers on the internal network that the Applio server has access to. As of time of publication, no known patches are available.

Affected products (as reported)

Vendor	Product	Versions
IAHispano	Applio	<= 3.2.8-bugfix

Weakness: CWE-200, CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

References

https://securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/ x_refsource_CONFIRM
https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L273 x_refsource_MISC
https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L816 x_refsource_MISC