IAHispano vulnerabilities
We track 11 vulnerabilities in IAHispano products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on March 19, 2025.
Latest IAHispano vulnerabilities
- 7.5 High severity
Applio: Improper Limitation of a Pathname to a Restricted Directory
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to denial of service (DoS) in restart.py. `model_name` in train.py takes user input, and passes it to the `stop_train` function in restart.py, which uses it construct a path to a
- 9.1 Critical severity
Applio: Improper Limitation of a Pathname to a Restricted Directory
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file removal in core.py. `output_tts_path` in tts.py takes arbitrary user input and passes it to `run_tts_script` function in core.py, which checks if the path in `o
- 7.5 High severity
Applio: Improper Limitation of a Pathname to a Restricted Directory
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_index` function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind s
- 7.5 High severity
Applio: Exposure of Sensitive Information to an Unauthorized Actor
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_pth` function. This issue may lead to reading arbitrary files on the Applio server. It can also be used in conjunction with blind ser
- 9.8 Critical severity
Applio: Improper Limitation of a Pathname to a Restricted Directory
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in train.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to ach
- 9.8 Critical severity
Applio: Improper Limitation of a Pathname to a Restricted Directory
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in inference.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe deserialization to
- 9.8 Critical severity
Applio: Deserialization of Untrusted Data
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in inference.py. `model_file` in inference.py as well as `model_file` in tts.py take user-supplied input (e.g. a path to a model) and pass that value to
- 9.8 Critical severity
Applio: Deserialization of Untrusted Data
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in model_information.py. `model_name` in model_information.py takes user-supplied input (e.g. a path to a model) and pass that value to the `run_model_i
- 9.8 Critical severity
Applio: Deserialization of Untrusted Data
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `model_blender.py` lines 20 and 21. `model_fusion_a` and `model_fusion_b` from voice_blender.py take user-supplied input (e.g. a path to a model) and
- 9.8 Critical severity
Applio: Deserialization of Untrusted Data
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `infer.py`. The issue can lead to remote code execution. As of time of publication, a fix is available on the `main` branch of the Applio repository
- 7.5 High severity
Applio: Server-Side Request Forgery
Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) in `model_download.py` (line 195 in 3.2.7). The blind SSRF allows for sending requests on behalf of Applio server and can be leveraged to probe for