CVE-2025-27774 Overview
CVE-2025-27774 affects Applio, an open-source voice conversion tool maintained by IAHispano. Versions 3.2.7 and prior contain a server-side request forgery (SSRF) flaw and an arbitrary file write flaw in model_download.py at line 156. The blind SSRF lets attackers send arbitrary HTTP requests from the Applio server, enabling reconnaissance of internal networks and back-end services. The file write primitive allows attackers to place attacker-controlled files on the server file system. Chained with an arbitrary file read (such as CVE-2025-27784) or an unsafe deserialization sink, these primitives escalate into full SSRF and remote code execution. As of publication, no patches are available for CVE-2025-27774.
Critical Impact
Unauthenticated attackers can pivot into internal networks and write attacker-controlled files to the Applio host, enabling chained remote code execution.
Affected Products
- Applio versions 3.2.7 and prior
- rvc/lib/tools/model_download.py component
- Flask route defined in assets/flask/routes.py
Discovery Timeline
- 2025-03-19 - CVE-2025-27774 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27774
Vulnerability Analysis
Applio exposes a model download endpoint that accepts a user-supplied URL and fetches remote content on behalf of the server. The download handler in model_download.py does not validate the scheme, host, or destination path of the supplied URL. Attackers submit crafted URLs that instruct the server to contact arbitrary internal addresses. The server issues the HTTP request from its own network context, which typically has access to internal services blocked from the public internet. The same code path derives the local file name from the remote resource without normalization or allow-listing, producing an arbitrary file write on the server.
Root Cause
The vulnerability maps to [CWE-918] Server-Side Request Forgery. The download routine trusts remote user input for both the outbound request target and the resulting file name on disk. There is no scheme filtering, no host allow-list, no response size cap, and no path canonicalization before writing to disk. See the GitHub Security Advisory GHSL-2024-341 for the vulnerable code references.
Attack Vector
The attack requires network access to the Applio web interface and no authentication. An attacker submits a model download request pointing to an internal IP, cloud metadata endpoint, or local service. The server performs the request and stores the response to a path derived from the attacker-controlled URL. Chaining the SSRF with the arbitrary file read tracked as CVE-2025-27784 upgrades the blind SSRF to a full read primitive. Chaining the file write with an unsafe deserialization sink yields remote code execution on the Applio host.
The vulnerable code paths are documented in the referenced model_download.py snippet and the download tab handler.
Detection Methods for CVE-2025-27774
Indicators of Compromise
- Outbound HTTP requests from the Applio process to RFC1918 addresses, 127.0.0.1, or cloud metadata endpoints such as 169.254.169.254
- Newly created files under the Applio models directory with unexpected extensions or names derived from external URLs
- Access log entries hitting the model download endpoint with URLs pointing to internal hostnames
- Applio server contacting unusual TCP ports (22, 3306, 6379, 8080) on internal hosts
Detection Strategies
- Inspect Applio access logs for POST requests to the download route with url parameters targeting private IP ranges or file://, gopher://, or dict:// schemes
- Monitor the Applio working directory for file creation events that do not correspond to legitimate model downloads from Hugging Face or configured sources
- Baseline outbound network flows from the Applio host and alert on connections to internal management interfaces
Monitoring Recommendations
- Forward Applio Flask logs and process file activity to a central SIEM for correlation
- Deploy egress filtering that blocks the Applio host from reaching cloud metadata services and internal admin subnets
- Alert on process file writes outside the expected model storage directory
How to Mitigate CVE-2025-27774
Immediate Actions Required
- Restrict network access to the Applio web interface to trusted users only, using an authenticated reverse proxy or VPN
- Block outbound traffic from the Applio host to internal management ranges, loopback, and cloud metadata endpoints
- Remove or disable the model download endpoint if not required for operational workflows
- Run the Applio process under a low-privilege account with a read-only application directory
Patch Information
As of publication, no vendor patch is available for CVE-2025-27774. Track the Applio repository and the GitHub Security Advisory for fix availability. Downgrade is not an option because all versions through 3.2.7 are affected.
Workarounds
- Deploy a network policy that permits outbound connections only to known model repository domains such as huggingface.co
- Terminate the Flask model download route in a reverse proxy configuration until a patch ships
- Run Applio inside a container with a read-only file system and no access to internal networks
- Enforce URL scheme allow-listing (https only) at a proxy in front of the Applio server
# Example egress restriction using iptables to block internal ranges and metadata
iptables -A OUTPUT -m owner --uid-owner applio -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner applio -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner applio -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner applio -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -m owner --uid-owner applio -d 127.0.0.0/8 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
