---
id: CVE-2026-43624
title: F5-TTS 1.1.20 Path Traversal via finetune_gradio.py create_data_project()
summary: >-
  F5-TTS through version 1.1.20 contains a path traversal vulnerability in the
  finetune Gradio handlers that allows unauthenticated attackers to write
  arbitrary files by passing unsanitized user-supplied project names directly to
  os.path.j…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-22
vendor: SWivid
product: F5-TTS
affected:
  - F5-TTS <= 1.1.20
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-01T18:58:24.278783Z'
published: '2026-06-01'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:03:26.190Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43624'
references:
  - url: 'https://github.com/SWivid/F5-TTS/issues/1293'
  - url: 'https://github.com/SWivid/F5-TTS/pull/1294'
  - url: >-
      https://github.com/SWivid/F5-TTS/commit/2f53ded68e5f69e248ceb200a51ef4d1dc647936
  - url: >-
      https://www.vulncheck.com/advisories/f5-tts-path-traversal-via-finetune-gradio-py-create-data-project
tags:
  - cve.org
epss: 0.00587
epssPercentile: 0.48305
ingestedAt: '2026-11-08T14:51:22.429Z'
---

## Overview

F5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows unauthenticated attackers to write arbitrary files by passing unsanitized user-supplied project names directly to os.path.join() without validating the resulting path stays within the intended base directory. Attackers can supply absolute path arguments such as /tmp/EVIL to override the base directory entirely and create arbitrary directories with attacker-controlled JSON content at any filesystem path writable by the server process.

## Affected

- `F5-TTS <= 1.1.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.