CVE-2026-122159

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122159", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-11-04T18:51:42.118Z", "datePublished": "2026-11-05T02:15:21.247Z", "dateUpdated": "2026-11-05T20:38:11.426Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T02:15:21.247Z"}, "title": "Edge0-AI Audio8_TTS Model Path Resolution runtime.py ArkTtsRuntime.__init__ path traversal", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "Path Traversal"}]}], "affected": [{"vendor": "Edge0-AI", "product": "Audio8_TTS", "versions": [{"version": "1d64afcc2da56222b41ddcf53de7b8bc54be1fb6", "status": "affected"}], "cpes": ["cpe:2.3:a:edge0-ai:audio8_tts:*:*:*:*:*:*:*:*"], "modules": ["Model Path Resolution"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Edge0-AI Audio8_TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.__init__ of the file onnx_runtime_0_1b_int8/arktts_runtime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slow_decode_models can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-11-04T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-11-04T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-11-04T19:56:46.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Dem000000 (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/431159", "name": "VDB-431159 | Edge0-AI Audio8_TTS Model Path Resolution runtime.py ArkTtsRuntime.__init__ path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431159/cti", "name": "VDB-431159 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-122159", "name": "CVE-2026-122159 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1028151", "name": "Submit #1028151 | Edge0-AI Audio8_TTS commit 07e40f5d0b03 Path Traversal", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Edge0-AI/Audio8_TTS/issues/41", "tags": ["issue-tracking"]}, {"url": "https://github.com/user-attachments/files/33392182/poc.zip", "tags": ["exploit"]}, {"url": "https://github.com/Edge0-AI/Audio8_TTS/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T20:38:01.130567Z", "id": "CVE-2026-122159", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:38:11.426Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122159", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T20:38:01.130567Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:38:07.659Z"}}], "cna": {"title": "Edge0-AI Audio8_TTS Model Path Resolution runtime.py ArkTtsRuntime.__init__ path traversal", "credits": [{"lang": "en", "type": "reporter", "value": "Dem000000 (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:edge0-ai:audio8_tts:*:*:*:*:*:*:*:*"], "vendor": "Edge0-AI", "modules": ["Model Path Resolution"], "product": "Audio8_TTS", "versions": [{"status": "affected", "version": "1d64afcc2da56222b41ddcf53de7b8bc54be1fb6"}]}], "timeline": [{"lang": "en", "time": "2026-11-04T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-11-04T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-11-04T19:56:46.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/431159", "name": "VDB-431159 | Edge0-AI Audio8_TTS Model Path Resolution runtime.py ArkTtsRuntime.__init__ path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/431159/cti", "name": "VDB-431159 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-122159", "name": "CVE-2026-122159 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/1028151", "name": "Submit #1028151 | Edge0-AI Audio8_TTS commit 07e40f5d0b03 Path Traversal", "tags": ["third-party-advisory"]}, {"url": "https://github.com/Edge0-AI/Audio8_TTS/issues/41", "tags": ["issue-tracking"]}, {"url": "https://github.com/user-attachments/files/33392182/poc.zip", "tags": ["exploit"]}, {"url": "https://github.com/Edge0-AI/Audio8_TTS/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202611"], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Edge0-AI Audio8_TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.__init__ of the file onnx_runtime_0_1b_int8/arktts_runtime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slow_decode_models can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Path Traversal"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-11-05T02:15:21.247Z"}}}, "cveMetadata": {"cveId": "CVE-2026-122159", "state": "PUBLISHED", "dateUpdated": "2026-11-05T20:38:11.426Z", "dateReserved": "2026-11-04T18:51:42.118Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-11-05T02:15:21.247Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:edge0-ai:audio8_tts:*:*:*:*:*:*:*:*"], "modules": ["Model Path Resolution"], "product": "Audio8_TTS", "vendor": "Edge0-AI", "versions": [{"status": "affected", "version": "1d64afcc2da56222b41ddcf53de7b8bc54be1fb6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Edge0-AI Audio8_TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.__init__ of the file onnx_runtime_0_1b_int8/arktts_runtime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slow_decode_models can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet."}], "id": "CVE-2026-122159", "lastModified": "2026-11-05T21:18:43.690", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122159", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T20:38:01.130567Z", "version": "2.0.3"}}]}, "published": "2026-11-05T03:17:20.920", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Edge0-AI/Audio8_TTS/"}, {"source": "cna@vuldb.com", "url": "https://github.com/Edge0-AI/Audio8_TTS/issues/41"}, {"source": "cna@vuldb.com", "url": "https://github.com/user-attachments/files/33392182/poc.zip"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-122159"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/1028151"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431159"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/431159/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "Audio8_TTS: Audio8_TTS: Path traversal via manipulated model path argument", "id": "2567662", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567662"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-22", "details": ["A weakness has been identified in Edge0-AI Audio8_TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.__init__ of the file onnx_runtime_0_1b_int8/arktts_runtime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slow_decode_models can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.", "A flaw was found in Audio8_TTS. A remote attacker could exploit this vulnerability by supplying a manipulated path in the model configuration parameters, such as the slow_decode_models argument during runtime initialization. This leads to path traversal, potentially allowing the attacker to access arbitrary files outside the intended directory."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122159", "public_date": "2026-11-05T02:15:21Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122159\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122159\nhttps://github.com/Edge0-AI/Audio8_TTS/\nhttps://github.com/Edge0-AI/Audio8_TTS/issues/41\nhttps://github.com/user-attachments/files/33392182/poc.zip\nhttps://vuldb.com/cve/CVE-2026-122159\nhttps://vuldb.com/submit/1028151\nhttps://vuldb.com/vuln/431159\nhttps://vuldb.com/vuln/431159/cti"], "statement": "This vulnerability is classified as having a Moderate impact by Red Hat because traversing directories requires an application or user to provide crafted model location paths, constraining the blast radius to the execution context of the process. Furthermore, Audio8_TTS is not shipped or supported within any Red Hat products, ensuring default enterprise environments remain unaffected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "1d64afcc2da56222b41ddcf53de7b8bc54be1fb6"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Audio8_TTS", "source": "cna", "vendor": "Edge0-AI"}, "product": "audio8_tts", "vendor": "edge0-ai"}], "created": "2026-11-05T03:45:18.528272+00:00", "updated": "2026-11-06T21:27:03.712504+00:00", "vendors": ["edge0-ai", "edge0-ai$PRODUCT$audio8_tts"]}