プラットフォーム
python
コンポーネント
vociferous
修正版
4.4.3
CVE-2026-27897 describes a critical Path Traversal vulnerability discovered in Vociferous, a cross-platform, offline speech-to-text application. This flaw allows an attacker to read arbitrary files on the server due to inadequate filename validation within the export_file API route. The vulnerability affects versions of Vociferous prior to 4.4.2 and can be exploited remotely due to permissive CORS configuration.
The impact of this vulnerability is severe. An attacker can leverage the Path Traversal flaw to read sensitive files from the server's filesystem. This could include configuration files, database credentials, source code, or other confidential data. The unauthenticated nature of the API, combined with the overly permissive CORS policy (allowing all origins), significantly increases the attack surface. An attacker could potentially gain complete control over the affected system by exploiting this vulnerability to read and modify critical files. The lack of authentication means no user interaction is required for exploitation.
This vulnerability was publicly disclosed on 2026-03-11. No known public exploits or active campaigns have been reported at the time of writing. The vulnerability's ease of exploitation, coupled with the lack of authentication, suggests a potential for widespread exploitation if a readily available exploit is developed. It is recommended to prioritize patching.
Organizations utilizing Vociferous for offline speech-to-text processing, particularly those with publicly accessible APIs or those running Vociferous on shared hosting environments, are at significant risk. Systems with older, unpatched versions of Vociferous are especially vulnerable.
• python / server:
import os
import json
# Check for the vulnerable code in src/api/system.py
with open('src/api/system.py', 'r') as f:
content = f.read()
if 'os.path.join' in content and 'filename' in content and 'export_file' in content:
print('Potential CVE-2026-27897 vulnerability detected.')• generic web:
curl -X POST -d '{"filename": "../../../../etc/passwd", "content": "test"}' http://<target_host>/export_file• generic web:
# Check for file access attempts in access logs
grep -iE 'export_file|../' /var/log/apache2/access.logdisclosure
エクスプロイト状況
EPSS
0.06% (20% パーセンタイル)
CISA SSVC
CVSS ベクトル
The primary mitigation for CVE-2026-27897 is to upgrade Vociferous to version 4.4.2 or later, which includes the necessary filename validation fixes. If upgrading immediately is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious characters in the filename parameter. Additionally, restrict the CORS configuration in app.py to only allow trusted origins. Thoroughly review the src/api/system.py file for any other potential vulnerabilities.
Vociferousをバージョン4.4.2以降にアップデートしてください。このバージョンでは、ファイル名を処理する前に正しく検証することで、パストラバーサル脆弱性を修正しています。アップデートにより、外部攻撃者が意図しない場所に任意のデータを書き込むことを防ぎます。
脆弱性分析と重要アラートをメールでお届けします。
CVE-2026-27897 is a critical Path Traversal vulnerability affecting Vociferous versions prior to 4.4.2. It allows attackers to read arbitrary files on the server due to insufficient filename validation in the export_file API.
You are affected if you are using Vociferous version 4.4.2 or earlier. Check your version and upgrade immediately.
Upgrade Vociferous to version 4.4.2 or later. As a temporary workaround, implement a WAF rule to block suspicious filenames and restrict CORS.
No active exploitation has been confirmed at this time, but the vulnerability's ease of exploitation warrants immediate attention and patching.
Refer to the Vociferous project's official website or GitHub repository for the latest security advisories and updates.
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
requirements.txt ファイルをアップロードすると、影響の有無を即座にお知らせします。