CVE-2026-8755

HIGH 7.3

fishaudio Bert-VITS2 Model hiyoriUI.py _get_all_models path traversal

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is the function _get_all_models of the file hiyoriUI.py of the component Model Handler. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-22
Vendor	fishaudio
Product	bert-vits2
Published	May 17, 2026
Last Updated	May 18, 2026

Stay Ahead of the Next One

Get instant alerts for fishaudio bert-vits2

Be the first to know when new high vulnerabilities affecting fishaudio bert-vits2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

fishaudio / Bert-VITS2

8f7fbd8c4770965225d258db548da27dc8dd934c

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/364382 vuldb.com: https://vuldb.com/vuln/364382/cti vuldb.com: https://vuldb.com/submit/811173 gist.github.com: https://gist.github.com/YLChen-007/99859f4f836cca523a5982645e7fdd97

Credits

🔍 Eric-b (VulDB User) VulDB CNA Team