So Vits Svc
Approved changes feed: RSS · Atom
cpe:2.3:a:svc-develop-team:so-vits-svc:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Svc Develop Team (36004df5-350e-5934-9292-24bb7c4801c6) |
|---|---|
| Product | So Vits Svc (f96b4191-c91f-57ef-945f-53226880a74d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-65701 |
vulnerable | 2026-07-29 01:06:20.227649 |
SoftVC VITS Singing Voice Conversion Path Traversal via /wav2wav Flask Route
CRITICAL (9.1)
SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audio_path field of an unauthenticated POST request to the /wav2wav route. Attackers can pass arbitrary server-side paths verbatim to librosa.load, torchaudio.load, and soundfile.write sinks, causing the server to decode and return file contents via the HTTP response body while also writing attacker-specified .wav files to arbitrary locations on the filesystem.
Published: 2026-07-23T17:05:47.594Z
Updated: 2026-07-23T18:04:13.633Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.