High severity7.5NVD Advisory· Published Mar 19, 2025· Updated Jun 17, 2026

CVE-2025-27785

Description

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's export_index function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind server-side request forgery to read files from servers on the internal network that the Applio server has access to. As of time of publication, no known patches are available.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

GitHub/Appliollm-create
Range: <=3.2.8-bugfix
Applio/Appliollm-fuzzy
Range: <=3.2.8-bugfix
IAHispano/Appliov5
Range: <= 3.2.8-bugfix

Patches

Vulnerability mechanics

References

securitylab.github.com/advisories/GHSL-2024-341_GHSL-2024-353_Applio/nvdVendor Advisory
github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.pynvdProduct
github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.pynvdProduct

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000