CVE-2025-27786: Critical Arbitrary File Removal in Applio core.py

CVE-2025-27786 is a critical (CVSS 9.1) path traversal flaw in core.py in Applio 3.2.8-bugfix and earlier. The text to speech output path is checked and, if it exists, removed, which allows arbitrary file deletion. The record names no patch, so isolate the app.

What's affected

The record says Applio versions 3.2.8-bugfix and prior are affected. Applio is described as a voice conversion tool. The record says output_tts_path in tts.py takes arbitrary user input and passes it to the run_tts_script function in core.py. That function checks whether the path exists and, if it does, removes it.

As of publication, the record says no known patches are available.

This CVE is one of thirteen reported together by GitHub Security Lab in CVE-2025-27774 to CVE-2025-27786, covering unsafe deserialization, server-side request forgery, arbitrary file write, arbitrary file read and arbitrary file removal in the same project.

Severity in the record: critical, CVSS 9.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Weakness classes: CWE-22 (Path traversal).

How to check if you're exposed

Applio is a Python application, so check how you installed it.

git -C /path/to/Applio log -1 --format=%H
git -C /path/to/Applio describe --tags
pip list 2>/dev/null | grep -i applio

The record says versions 3.2.8-bugfix and prior are affected. If you track the main branch, compare your commit with the fix commits linked in Sources.

Then check exposure. Applio runs a web interface with tabs for inference, text to speech, training and model tools. Find out whether it listens on anything other than localhost and whether it sits behind a reverse proxy, a tunnel or a public share link.

For the Python packages your own projects pull in, the free in-browser scan at gold.safeguard.sh/scan reads requirements.txt.

What to do now

1. Stop exposing the Applio interface to untrusted networks. Bind it to localhost or a private network and put authentication in front of it.
2. Check the project's releases and the advisory for a fix, and apply it as soon as one exists. Until then treat the application as unpatched.
3. Do not load model files, checkpoints or paths that you did not create or verify yourself.
4. Run Applio as a low privilege user, ideally in a container or virtual machine with no access to your other files or credentials.
5. Keep backups of the Applio folder and of any models you care about, and run the service as a user that cannot delete anything else.
6. Subscribe to the repository's releases and the advisory so you hear when a numbered release carries the fix.

Why it matters

Path traversal (CWE-22) means the application uses a path supplied by the user without checking that it points where it should. Here the effect is deletion rather than writing: a user chooses a path, the program confirms it exists, and then removes it. Whatever the service account can delete, a remote user can delete.

The score is 9.1 rather than 9.8 because the vector scores no availability impact, only high confidentiality and integrity impact, even though deleting files plainly harms availability for a user. The practical point for a defender is the same either way: do not let this service run with rights over anything you cannot afford to lose, and keep it off untrusted networks.

The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.

Quick check

Sources

• GitHub Security Lab advisory GHSL-2024-341 to GHSL-2024-353
• https://github.com/IAHispano/Applio/blob/29b4a00e4be209f9aac51cd9ccffcc632dfb2973/core.py#L329
• Safeguard Gold entry for CVE-2025-27786

Last reviewed: 19 October 2026.