CVE-2026-8756

HIGH 7.3

fishaudio Bert-VITS2 Gradio webui_preprocess.py generate_config path traversal

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted element is the function generate_config of the file webui_preprocess.py of the component Gradio Interface. Such manipulation of the argument data_dir leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-22
Vendor	fishaudio
Product	bert-vits2
Published	May 17, 2026
Last Updated	May 18, 2026

Stay Ahead of the Next One

Get instant alerts for fishaudio bert-vits2

Be the first to know when new high vulnerabilities affecting fishaudio bert-vits2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

fishaudio / Bert-VITS2

8f7fbd8c4770965225d258db548da27dc8dd934c

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/364383 vuldb.com: https://vuldb.com/vuln/364383/cti vuldb.com: https://vuldb.com/submit/811175 gist.github.com: https://gist.github.com/YLChen-007/550cb92f3489c317ff049fc7d7ea6b99

Credits

🔍 Eric-b (VulDB User) VulDB CNA Team