CVE-2026-43624: F5-TTS 1.1.20 Path Traversal via finetune_gradio.py create_data_project()
F5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows unauthenticated attackers to write arbitrary files by passing unsanitized user-supplied project names directly to os.path.join() without validating the resulting path stays within the intended base directory. Attackers can supply absolute path arguments such as /tmp/EVIL to override the base directory entirely and create arbitrary directories with attacker-controlled JSON content at any filesystem path writable by the server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
F5-TTSto a version that resolves this vulnerability.Fixed in 1.1.20 - Compensating control
Restrict access to the finetune Gradio handlers (finetune_gradio.py create_data_project()) so unauthenticated users cannot submit crafted absolute path arguments (e.g., /tmp/EVIL) that exploit the path traversal to write arbitrary files.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43624?
The severity of CVE-2026-43624 is high with a score of 8.2.
How do I fix CVE-2026-43624?
To fix CVE-2026-43624, upgrade to F5-TTS version 1.1.21 or later that addresses the path traversal vulnerability.
What types of attacks are possible with CVE-2026-43624?
CVE-2026-43624 allows unauthenticated attackers to perform path traversal attacks, potentially leading to writing arbitrary files.
Which versions of F5-TTS are affected by CVE-2026-43624?
F5-TTS versions through 1.1.20 are affected by CVE-2026-43624.
What component of F5-TTS does CVE-2026-43624 affect?
CVE-2026-43624 affects the finetune Gradio handlers in F5-TTS.