Vulnerability · Published Jun 1, 2026 · Assigned by VulnCheck

CVE-2026-43624F5-TTS 1.1.20 Path Traversal via finetune_gradio.py create_data_project()

High 8.2

In plain English

A high-severity path traversal in F5-TTS from SWivid. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.6%top 51.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

F5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows unauthenticated attackers to write arbitrary files by passing unsanitized user-supplied project names directly to os.path.join() without validating the resulting path stays within the intended base directory. Attackers can supply absolute path arguments such as /tmp/EVIL to override the base directory entirely and create arbitrary directories with attacker-controlled JSON content at any filesystem path writable by the server process.

Affected products (as reported)

Vendor	Product	Versions
SWivid	F5-TTS	0 – through 1.1.20

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

References

https://github.com/SWivid/F5-TTS/issues/1293 issue-tracking
https://github.com/SWivid/F5-TTS/pull/1294 issue-tracking
https://github.com/SWivid/F5-TTS/commit/2f53ded68e5f69e248ceb200a51ef4d1dc647936 patch
https://www.vulncheck.com/advisories/f5-tts-path-traversal-via-finetune-gradio-py-create-data-project third-party-advisory