A critical path traversal vulnerability in fishaudio Bert-VITS2 allows unauthenticated attackers to potentially read sensitive system files.

The software suffers from a Path Traversal vulnerability (CWE-22) which permits unauthenticated attackers to traverse the filesystem and access files outside of the intended directory structure.

This vulnerability may lead to the disclosure of sensitive configuration files, source code, or internal system data, significantly increasing the risk of further system compromise. The CVSS score of 7.3 underscores the criticality of this flaw, as it allows attackers to bypass security boundaries without requiring any user credentials.

Immediate Action: Update the Bert-VITS2 implementation to the latest secure version provided by the developer and restrict directory access permissions.

Proactive Monitoring: Monitor system logs for file access requests containing directory traversal sequences such as "../" or absolute paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block requests containing path traversal sequences or directory navigation attempts.

Public Exploit Available: Unknown.

Given the potential for unauthorized file access, it is imperative to secure the environment by applying the latest software updates. If an update is not immediately available, ensure that the application process is running with the least-privilege principle to limit the impact of potential file traversal attempts.