CVE-2025-27782
Published: 19 March 2025
Summary
CVE-2025-27782 is a high-severity Path Traversal (CWE-22) vulnerability in Applio Applio. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Applio, an open-source voice conversion tool, is affected by an arbitrary file write vulnerability in versions 3.2.8-bugfix and earlier. The flaw, tracked as CWE-22, resides in inference.py and permits writing to arbitrary paths on the server; the same code paths can be chained with unsafe deserialization to obtain remote code execution. The issue carries a CVSS 4.0 score of 7.7 with a network attack vector and no required authentication or user interaction.
An unauthenticated attacker can send crafted requests directly to the inference endpoints, causing the application to write attacker-controlled content to any location on the underlying filesystem. Successful exploitation can therefore corrupt configuration files, overwrite application code, or stage malicious payloads that lead to full remote code execution when combined with the deserialization weakness.
Public references, including the GitHub Security Lab advisory GHSL-2024-341, confirm the vulnerable code locations but state that no patches were available at the time of disclosure. The EPSS score has remained in the 0.15–0.19 range without a pronounced post-disclosure climb.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6792
Vulnerability details
Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in inference.py. This issue may lead to writing arbitrary files on the Applio server. It can also be used in conjunction with an unsafe…
more
deserialization to achieve remote code execution. As of time of publication, no known patches are available.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a critical unauthenticated arbitrary file write in a public-facing Applio server application that chains with unsafe deserialization to enable RCE, directly mapping to T1190 for initial exploitation and T1059.006 for Python-based command execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates information inputs to inference.py and tts.py to block arbitrary file paths and prevent CWE-22 arbitrary file writes.
Establishes a risk-based process to identify, prioritize, and remediate the specific arbitrary file write flaw in Applio versions 3.2.8-bugfix and prior.
Enforces least privilege on the Applio process to restrict the scope and impact of arbitrary file writes, preventing writes to sensitive locations.