Plattform
python
Komponente
vociferous
Behoben in
4.4.3
CVE-2026-27897 describes a critical Path Traversal vulnerability discovered in Vociferous, a cross-platform, offline speech-to-text application. This flaw allows an attacker to read arbitrary files on the server due to inadequate filename validation within the export_file API route. The vulnerability affects versions of Vociferous prior to 4.4.2 and can be exploited remotely due to permissive CORS configuration.
The impact of this vulnerability is severe. An attacker can leverage the Path Traversal flaw to read sensitive files from the server's filesystem. This could include configuration files, database credentials, source code, or other confidential data. The unauthenticated nature of the API, combined with the overly permissive CORS policy (allowing all origins), significantly increases the attack surface. An attacker could potentially gain complete control over the affected system by exploiting this vulnerability to read and modify critical files. The lack of authentication means no user interaction is required for exploitation.
This vulnerability was publicly disclosed on 2026-03-11. No known public exploits or active campaigns have been reported at the time of writing. The vulnerability's ease of exploitation, coupled with the lack of authentication, suggests a potential for widespread exploitation if a readily available exploit is developed. It is recommended to prioritize patching.
Organizations utilizing Vociferous for offline speech-to-text processing, particularly those with publicly accessible APIs or those running Vociferous on shared hosting environments, are at significant risk. Systems with older, unpatched versions of Vociferous are especially vulnerable.
• python / server:
import os
import json
# Check for the vulnerable code in src/api/system.py
with open('src/api/system.py', 'r') as f:
content = f.read()
if 'os.path.join' in content and 'filename' in content and 'export_file' in content:
print('Potential CVE-2026-27897 vulnerability detected.')• generic web:
curl -X POST -d '{"filename": "../../../../etc/passwd", "content": "test"}' http://<target_host>/export_file• generic web:
# Check for file access attempts in access logs
grep -iE 'export_file|../' /var/log/apache2/access.logdisclosure
Exploit-Status
EPSS
0.06% (20% Perzentil)
CISA SSVC
CVSS-Vektor
The primary mitigation for CVE-2026-27897 is to upgrade Vociferous to version 4.4.2 or later, which includes the necessary filename validation fixes. If upgrading immediately is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious characters in the filename parameter. Additionally, restrict the CORS configuration in app.py to only allow trusted origins. Thoroughly review the src/api/system.py file for any other potential vulnerabilities.
Aktualisieren Sie Vociferous auf Version 4.4.2 oder höher. Diese Version behebt die Path-Traversal-Schwachstelle, indem sie Dateinamen vor der Verarbeitung korrekt validiert. Das Update verhindert, dass externe Angreifer beliebige Daten an unerwünschten Orten schreiben.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2026-27897 is a critical Path Traversal vulnerability affecting Vociferous versions prior to 4.4.2. It allows attackers to read arbitrary files on the server due to insufficient filename validation in the export_file API.
You are affected if you are using Vociferous version 4.4.2 or earlier. Check your version and upgrade immediately.
Upgrade Vociferous to version 4.4.2 or later. As a temporary workaround, implement a WAF rule to block suspicious filenames and restrict CORS.
No active exploitation has been confirmed at this time, but the vulnerability's ease of exploitation warrants immediate attention and patching.
Refer to the Vociferous project's official website or GitHub repository for the latest security advisories and updates.
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine requirements.txt-Datei hoch und wir sagen dir sofort, ob du betroffen bist.