CVE-2025-27783: Critical Arbitrary File Write in Applio train.py

CVE-2025-27783 is a critical (CVSS 9.8) path traversal flaw in train.py in Applio 3.2.8-bugfix and earlier. It allows files to be written anywhere the server can write, and can be combined with unsafe deserialization for code execution. The record names no patch, so isolate the app.

What's affected

The record says Applio versions 3.2.8-bugfix and prior are affected. Applio is described as a voice conversion tool. The weakness is an arbitrary file write in the training tab, in tabs/train/train.py.

As of publication, the record says no known patches are available.

This CVE is one of thirteen reported together by GitHub Security Lab in CVE-2025-27774 to CVE-2025-27786, covering unsafe deserialization, server-side request forgery, arbitrary file write, arbitrary file read and arbitrary file removal in the same project.

Severity in the record: critical, CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Weakness classes: CWE-22 (Path traversal).

How to check if you're exposed

Applio is a Python application, so check how you installed it.

git -C /path/to/Applio log -1 --format=%H
git -C /path/to/Applio describe --tags
pip list 2>/dev/null | grep -i applio

The record says versions 3.2.8-bugfix and prior are affected. If you track the main branch, compare your commit with the fix commits linked in Sources.

Then check exposure. Applio runs a web interface with tabs for inference, text to speech, training and model tools. Find out whether it listens on anything other than localhost and whether it sits behind a reverse proxy, a tunnel or a public share link.

For the Python packages your own projects pull in, the free in-browser scan at gold.safeguard.sh/scan reads requirements.txt.

What to do now

1. Stop exposing the Applio interface to untrusted networks. Bind it to localhost or a private network and put authentication in front of it.
2. Check the project's releases and the advisory for a fix, and apply it as soon as one exists. Until then treat the application as unpatched.
3. Do not load model files, checkpoints or paths that you did not create or verify yourself.
4. Run Applio as a low privilege user, ideally in a container or virtual machine with no access to your other files or credentials.
5. If you train models, do it on a machine that holds no other data, and copy the finished model out rather than mounting your home folder.
6. Subscribe to the repository's releases and the advisory so you hear when a numbered release carries the fix.

Why it matters

Path traversal (CWE-22) means the application builds a file path from input and does not keep it within the folder it meant to use. When that path is then written to, the attacker chooses where a file lands and, in some cases, what is in it. The record notes that an arbitrary file write can be combined with unsafe deserialization to reach remote code execution, so the two kinds of flaw in this project reinforce each other.

The 9.8 score reflects a network attack with no login and no interaction and high impact on confidentiality, integrity and availability. With no patch named in the record, the practical defence is to keep the interface off untrusted networks and to run it with the fewest rights possible, so that a file written anywhere cannot reach anything that matters.

The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.

Quick check

Sources

• GitHub Security Lab advisory GHSL-2024-341 to GHSL-2024-353
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/tabs/train/train.py#L212-L225
• Safeguard Gold entry for CVE-2025-27783

Last reviewed: 19 October 2026.