AVID-2026-R1506

Description

fishaudio/Bert-VITS2 Limited File Write in webui_preprocess.py generate_config function (CVE-2024-39688)

Details

Bert-VITS2 is the VITS2 Backbone with multilingual bert. User input supplied to the data_dir variable is concatenated with other folders and used to open a new file in the generate_config function, which leads to a limited file write. The issue allows for writing /config/config.json file in arbitrary directory on the server. If a given directory path doesn’t exist, the application will return an error, so this vulnerability could also be used to gain information about existing directories on the server. This affects fishaudio/Bert-VITS2 2.3 and earlier.

Reason for inclusion in AVID: CVE-2024-39688 describes a path traversal vulnerability in fishaudio/Bert-VITS2 web UI generate_config that allows limited file write to arbitrary directories, potentially exposing server configuration and directories. This affects an AI model deployment/serving component and is relevant to software used in AI pipelines; thus it is a software supply-chain issue within AI systems. It is a security vulnerability with CVSS details provided. Evidence includes the CVE entry and referenced advisories.

References

Affected or Relevant Artifacts

Developer: FishAudio
Deployer: FishAudio
Artifact Details:

Type	Name
System	Bert-VITS2

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Base Score	6.5
Base Severity	🟠 Medium
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	🟢 Low
Integrity Impact	🟢 Low
Availability Impact	NONE

CWE

ID	Description
CWE-22	CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2024-07-22
Version: 0.3.3
AVID Entry