Plataforma
python
Componente
vociferous
Corrigido em
4.4.3
CVE-2026-27897 describes a critical Path Traversal vulnerability discovered in Vociferous, a cross-platform, offline speech-to-text application. This flaw allows an attacker to read arbitrary files on the server due to inadequate filename validation within the export_file API route. The vulnerability affects versions of Vociferous prior to 4.4.2 and can be exploited remotely due to permissive CORS configuration.
The impact of this vulnerability is severe. An attacker can leverage the Path Traversal flaw to read sensitive files from the server's filesystem. This could include configuration files, database credentials, source code, or other confidential data. The unauthenticated nature of the API, combined with the overly permissive CORS policy (allowing all origins), significantly increases the attack surface. An attacker could potentially gain complete control over the affected system by exploiting this vulnerability to read and modify critical files. The lack of authentication means no user interaction is required for exploitation.
This vulnerability was publicly disclosed on 2026-03-11. No known public exploits or active campaigns have been reported at the time of writing. The vulnerability's ease of exploitation, coupled with the lack of authentication, suggests a potential for widespread exploitation if a readily available exploit is developed. It is recommended to prioritize patching.
Organizations utilizing Vociferous for offline speech-to-text processing, particularly those with publicly accessible APIs or those running Vociferous on shared hosting environments, are at significant risk. Systems with older, unpatched versions of Vociferous are especially vulnerable.
• python / server:
import os
import json
# Check for the vulnerable code in src/api/system.py
with open('src/api/system.py', 'r') as f:
content = f.read()
if 'os.path.join' in content and 'filename' in content and 'export_file' in content:
print('Potential CVE-2026-27897 vulnerability detected.')• generic web:
curl -X POST -d '{"filename": "../../../../etc/passwd", "content": "test"}' http://<target_host>/export_file• generic web:
# Check for file access attempts in access logs
grep -iE 'export_file|../' /var/log/apache2/access.logdisclosure
Status do Exploit
EPSS
0.06% (percentil 20%)
CISA SSVC
Vetor CVSS
The primary mitigation for CVE-2026-27897 is to upgrade Vociferous to version 4.4.2 or later, which includes the necessary filename validation fixes. If upgrading immediately is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious characters in the filename parameter. Additionally, restrict the CORS configuration in app.py to only allow trusted origins. Thoroughly review the src/api/system.py file for any other potential vulnerabilities.
Atualize Vociferous para a versão 4.4.2 ou superior. Esta versão corrige a vulnerabilidade de traversal de caminho ao validar corretamente os nomes de arquivo antes de processá-los. A atualização evitará que atacantes externos escrevam dados arbitrários em locais indesejados.
Análise de vulnerabilidades e alertas críticos diretamente no seu e-mail.
CVE-2026-27897 is a critical Path Traversal vulnerability affecting Vociferous versions prior to 4.4.2. It allows attackers to read arbitrary files on the server due to insufficient filename validation in the export_file API.
You are affected if you are using Vociferous version 4.4.2 or earlier. Check your version and upgrade immediately.
Upgrade Vociferous to version 4.4.2 or later. As a temporary workaround, implement a WAF rule to block suspicious filenames and restrict CORS.
No active exploitation has been confirmed at this time, but the vulnerability's ease of exploitation warrants immediate attention and patching.
Refer to the Vociferous project's official website or GitHub repository for the latest security advisories and updates.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Envie seu arquivo requirements.txt e descubra na hora se você está afetado.