Cyber Posture

CVE-2025-27782

CriticalPublic PoC

Published: 19 March 2025

Published
19 March 2025
Modified
01 August 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1536 94.7th percentile
Risk Priority 29 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-27782 is a critical-severity Path Traversal (CWE-22) vulnerability in Applio Applio. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Validates information inputs to inference.py and tts.py to block arbitrary file paths and prevent CWE-22 arbitrary file writes.

prevent

Establishes a risk-based process to identify, prioritize, and remediate the specific arbitrary file write flaw in Applio versions 3.2.8-bugfix and prior.

prevent

Enforces least privilege on the Applio process to restrict the scope and impact of arbitrary file writes, preventing writes to sensitive locations.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.006 Python Execution
Adversaries may abuse Python commands and scripts for execution.
Why these techniques?

The vulnerability is a critical unauthenticated arbitrary file write in a public-facing Applio server application that chains with unsafe deserialization to enable RCE, directly mapping to T1190 for initial exploitation and T1059.006 for Python-based command execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in inference.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe…

more

deserialization to achieve remote code execution. As of time of publication, no known patches are available.

Deeper analysisAI

CVE-2025-27782 is an arbitrary file write vulnerability (CWE-22) in Applio, an open-source voice conversion tool. It affects versions 3.2.8-bugfix and prior, specifically within the inference.py component. The flaw enables attackers to write arbitrary files on the Applio server, with code locations referenced in inference.py lines 1632-1645, 295, and 989-1002, as well as tts.py lines 309-322. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its network accessibility, low attack complexity, and lack of prerequisites.

Unauthenticated remote attackers can exploit this vulnerability over the network without user interaction or privileges (AV:N/AC:L/PR:N/UI:N/S:U), potentially achieving high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). The arbitrary file write can be chained with an unsafe deserialization mechanism to enable remote code execution on the Applio server.

The GitHub Security Lab advisory (GHSL-2024-341_GHSL-2024-353_Applio) documents the issue but notes that, as of the CVE's publication on 2025-03-19T21:15:40.267, no patches or mitigations are available for affected versions. Security practitioners should monitor the Applio repository for updates and consider restricting network access to Applio instances until remediation is released.

Details

CWE(s)

Affected Products

applio
applio
≤ 3.2.8-bugfix

CVEs Like This One

CVE-2025-27783Same product: Applio Applio
CVE-2025-27786Same product: Applio Applio
CVE-2025-27780Same product: Applio Applio
CVE-2025-27781Same product: Applio Applio
CVE-2025-27779Same product: Applio Applio
CVE-2025-27785Same product: Applio Applio
CVE-2025-27787Same product: Applio Applio
CVE-2025-27778Same product: Applio Applio
CVE-2025-27777Same product: Applio Applio
CVE-2025-27784Same product: Applio Applio

References