---
id: CVE-2026-122159
title: >-
  Edge0-AI Audio8_TTS Model Path Resolution runtime.py ArkTtsRuntime.__init__
  path traversal
summary: >-
  A weakness has been identified in Edge0-AI Audio8_TTS up to
  1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function
  ArkTtsRuntime.__init__ of the file
  onnx_runtime_0_1b_int8/arktts_runtime/runtime.py of the component Model Pa…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-22
vendor: Edge0-AI
product: Audio8_TTS
affected:
  - Audio8_TTS 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:38:01.130567Z'
exploitAvailable: true
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:38:11.426Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122159'
references:
  - url: 'https://vuldb.com/vuln/431159'
    label: >-
      VDB-431159 | Edge0-AI Audio8_TTS Model Path Resolution runtime.py
      ArkTtsRuntime.__init__ path traversal
  - url: 'https://vuldb.com/vuln/431159/cti'
    label: 'VDB-431159 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-122159'
    label: CVE-2026-122159 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1028151'
    label: 'Submit #1028151 | Edge0-AI Audio8_TTS commit 07e40f5d0b03 Path Traversal'
  - url: 'https://github.com/Edge0-AI/Audio8_TTS/issues/41'
  - url: 'https://github.com/user-attachments/files/33392182/poc.zip'
  - url: 'https://github.com/Edge0-AI/Audio8_TTS/'
tags:
  - cve.org
  - exploit-available
epss: 0.00406
epssPercentile: 0.35131
ingestedAt: '2026-11-05T22:38:31.842Z'
---

## Overview

A weakness has been identified in Edge0-AI Audio8_TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.__init__ of the file onnx_runtime_0_1b_int8/arktts_runtime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slow_decode_models can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

## Affected

- `Audio8_TTS 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.