Platform
python
Component
vociferous
Fixed in
4.4.3
CVE-2026-27897 describes a critical Path Traversal vulnerability discovered in Vociferous, a cross-platform, offline speech-to-text application. This flaw allows an attacker to read arbitrary files on the server due to inadequate filename validation within the export_file API route. The vulnerability affects versions of Vociferous prior to 4.4.2 and can be exploited remotely due to permissive CORS configuration.
The impact of this vulnerability is severe. An attacker can leverage the Path Traversal flaw to read sensitive files from the server's filesystem. This could include configuration files, database credentials, source code, or other confidential data. The unauthenticated nature of the API, combined with the overly permissive CORS policy (allowing all origins), significantly increases the attack surface. An attacker could potentially gain complete control over the affected system by exploiting this vulnerability to read and modify critical files. The lack of authentication means no user interaction is required for exploitation.
This vulnerability was publicly disclosed on 2026-03-11. No known public exploits or active campaigns have been reported at the time of writing. The vulnerability's ease of exploitation, coupled with the lack of authentication, suggests a potential for widespread exploitation if a readily available exploit is developed. It is recommended to prioritize patching.
Exploit Status
EPSS
0.06% (20% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-27897 is to upgrade Vociferous to version 4.4.2 or later, which includes the necessary filename validation fixes. If upgrading immediately is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious characters in the filename parameter. Additionally, restrict the CORS configuration in app.py to only allow trusted origins. Thoroughly review the src/api/system.py file for any other potential vulnerabilities.
Update Vociferous to version 4.4.2 or higher. This version corrects the path traversal vulnerability by properly validating filenames before processing them. The update will prevent external attackers from writing arbitrary data to unwanted locations.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-27897 is a critical Path Traversal vulnerability affecting Vociferous versions prior to 4.4.2. It allows attackers to read arbitrary files on the server due to insufficient filename validation in the export_file API.
You are affected if you are using Vociferous version 4.4.2 or earlier. Check your version and upgrade immediately.
Upgrade Vociferous to version 4.4.2 or later. As a temporary workaround, implement a WAF rule to block suspicious filenames and restrict CORS.
No active exploitation has been confirmed at this time, but the vulnerability's ease of exploitation warrants immediate attention and patching.
Refer to the Vociferous project's official website or GitHub repository for the latest security advisories and updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your requirements.txt file and we'll tell you instantly if you're affected.