4.4.3
CVE-2026-27897 describes a critical Path Traversal vulnerability discovered in Vociferous, a cross-platform, offline speech-to-text application. This flaw allows an attacker to read arbitrary files on the server due to inadequate filename validation within the export_file API route. The vulnerability affects versions of Vociferous prior to 4.4.2 and can be exploited remotely due to permissive CORS configuration.
The impact of this vulnerability is severe. An attacker can leverage the Path Traversal flaw to read sensitive files from the server's filesystem. This could include configuration files, database credentials, source code, or other confidential data. The unauthenticated nature of the API, combined with the overly permissive CORS policy (allowing all origins), significantly increases the attack surface. An attacker could potentially gain complete control over the affected system by exploiting this vulnerability to read and modify critical files. The lack of authentication means no user interaction is required for exploitation.
This vulnerability was publicly disclosed on 2026-03-11. No known public exploits or active campaigns have been reported at the time of writing. The vulnerability's ease of exploitation, coupled with the lack of authentication, suggests a potential for widespread exploitation if a readily available exploit is developed. It is recommended to prioritize patching.
Organizations utilizing Vociferous for offline speech-to-text processing, particularly those with publicly accessible APIs or those running Vociferous on shared hosting environments, are at significant risk. Systems with older, unpatched versions of Vociferous are especially vulnerable.
• python / server:
import os
import json
# Check for the vulnerable code in src/api/system.py
with open('src/api/system.py', 'r') as f:
content = f.read()
if 'os.path.join' in content and 'filename' in content and 'export_file' in content:
print('Potential CVE-2026-27897 vulnerability detected.')• generic web:
curl -X POST -d '{"filename": "../../../../etc/passwd", "content": "test"}' http://<target_host>/export_file• generic web:
# Check for file access attempts in access logs
grep -iE 'export_file|../' /var/log/apache2/access.logdisclosure
漏洞利用状态
EPSS
0.06% (20% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2026-27897 is to upgrade Vociferous to version 4.4.2 or later, which includes the necessary filename validation fixes. If upgrading immediately is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious characters in the filename parameter. Additionally, restrict the CORS configuration in app.py to only allow trusted origins. Thoroughly review the src/api/system.py file for any other potential vulnerabilities.
将 Vociferous 更新到 4.4.2 或更高版本。此版本通过正确验证文件名后再进行处理，从而修复了路径遍历漏洞。更新将防止外部攻击者将数据写入不希望的位置。
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2026-27897 is a critical Path Traversal vulnerability affecting Vociferous versions prior to 4.4.2. It allows attackers to read arbitrary files on the server due to insufficient filename validation in the export_file API.
You are affected if you are using Vociferous version 4.4.2 or earlier. Check your version and upgrade immediately.
Upgrade Vociferous to version 4.4.2 or later. As a temporary workaround, implement a WAF rule to block suspicious filenames and restrict CORS.
No active exploitation has been confirmed at this time, but the vulnerability's ease of exploitation warrants immediate attention and patching.
Refer to the Vociferous project's official website or GitHub repository for the latest security advisories and updates.
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。
上传你的 requirements.txt 文件，立即知道是否受影响。