{"id":"CVE-2026-43624","title":"F5-TTS 1.1.20 Path Traversal via finetune_gradio.py create_data_project()","summary":"F5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows unauthenticated attackers to write arbitrary files by passing unsanitized user-supplied project names directly to os.path.j…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","cvssSource":"cna","cwe":["CWE-22"],"vendor":"SWivid","product":"F5-TTS","affected":["F5-TTS <= 1.1.20"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-06-01T18:58:24.278783Z"},"published":"2026-06-01","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:03:26.190Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43624","references":[{"url":"https://github.com/SWivid/F5-TTS/issues/1293"},{"url":"https://github.com/SWivid/F5-TTS/pull/1294"},{"url":"https://github.com/SWivid/F5-TTS/commit/2f53ded68e5f69e248ceb200a51ef4d1dc647936"},{"url":"https://www.vulncheck.com/advisories/f5-tts-path-traversal-via-finetune-gradio-py-create-data-project"}],"tags":["cve.org"],"epss":0.00587,"epssPercentile":0.48305,"ingestedAt":"2026-11-08T14:51:22.429Z","slug":"CVE-2026-43624","body":"## Overview\n\nF5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows unauthenticated attackers to write arbitrary files by passing unsanitized user-supplied project names directly to os.path.join() without validating the resulting path stays within the intended base directory. Attackers can supply absolute path arguments such as /tmp/EVIL to override the base directory entirely and create arbitrary directories with attacker-controlled JSON content at any filesystem path writable by the server process.\n\n## Affected\n\n- `F5-TTS <= 1.1.20`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}