Medium severity5.8NVD Advisory· Published Mar 5, 2026· Updated Apr 27, 2026
CVE-2024-43035
CVE-2024-43035
Description
Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@fonoster/voicenpm | >= 0.5.5, < 0.6.1 | 0.6.1 |
Affected products
1Patches
13ede81cb28c3Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4News mentions
0No linked articles in our index yet.