CVE-2026-112078: RVC-Project Retrieval-based-Voice-Conversion-WebUI webui.py change_info_ code injection
A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function changeinfo of the file webui.py. Executing a manipulation of the argument ckptpath can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
RVC-Project Retrieval-based-Voice-Conversion-WebUI versions up to 2.3.260718 are affected, specifically the change_info_ function in webui.py.
What does an attacker need to exploit this issue?
The attacker needs to be able to remotely submit a manipulated ckpt_path argument to the affected function. No privileges are required, but user interaction is required according to the supplied severity vector.
Is public exploit code available?
Yes. The available information states that an exploit has been published and may be used.
Is a vendor fix available?
The project was notified through an issue report but had not responded at the time of publication. No patched version or mitigation is provided in the available information.