CVE-2025-27775: Applio SSRF Vulnerability

CVE-2025-27775 Overview

CVE-2025-27775 affects Applio, an open-source voice conversion tool. Versions 3.2.7 and prior contain a Server-Side Request Forgery (SSRF) [CWE-918] and an arbitrary file write vulnerability in model_download.py. Attackers can force the Applio server to issue outbound requests to internal systems and write files to arbitrary locations on the host. Chained with unsafe deserialization or other flaws, the file write can enable remote code execution. No patch is available at the time of publication.

Critical Impact
Unauthenticated attackers can pivot into internal networks via blind SSRF and drop attacker-controlled files onto the Applio server, creating a foothold for remote code execution.

Affected Products

Applio versions 3.2.7 and prior
rvc/lib/tools/model_download.py component
Flask routes exposed under assets/flask/routes.py

Discovery Timeline

2025-03-19 - CVE-2025-27775 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27775

Vulnerability Analysis

Applio exposes a model download feature that accepts a user-supplied URL and downloads a remote resource to the server file system. The handler in rvc/lib/tools/model_download.py performs the fetch without validating the destination host, the URL scheme, or the resulting file path. This produces two distinct primitives from a single request. The first primitive is a blind SSRF that reaches internal services accessible from the Applio host. The second primitive is a write-what-where operation on the local file system, controlled by attacker-supplied filenames and content returned by the remote server.

The SSRF is classed as blind because response bodies are not returned to the caller. Attackers can still enumerate internal services through timing, error signatures, and side effects on downstream systems. The file write becomes a code execution vector when combined with Applio's model loading logic, which deserializes downloaded artifacts. Writing a crafted pickle payload to a path that Applio later loads yields arbitrary code execution in the server process.

Root Cause

The download routine trusts client-supplied input for both the source URL and the target filename. It lacks allowlisting of outbound destinations, blocking of private IP ranges and loopback addresses, and sanitization of the derived output path. The route in assets/flask/routes.py invokes the download logic without authentication.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to the model download endpoint with a URL pointing to an internal service such as http://127.0.0.1:8080/ or cloud metadata endpoints like http://169.254.169.254/. The server issues the request on the attacker's behalf. To achieve file write, the attacker points the URL at a controlled host that returns arbitrary bytes with a filename that lands the file inside an Applio directory read during model load. Technical references for the vulnerable code paths are published in the GitHub Security Advisory.

Detection Methods for CVE-2025-27775

Indicators of Compromise

Outbound HTTP requests from the Applio process to RFC1918 addresses, loopback, or cloud metadata IPs such as 169.254.169.254
New or modified files under Applio model directories with unexpected extensions such as .pkl, .pth, or .py
Requests to /download or Flask routes defined in assets/flask/routes.py originating from untrusted networks

Detection Strategies

Inspect web server and reverse proxy logs for POST or GET requests to Applio download endpoints containing url= parameters referencing internal hosts
Alert when the Applio process spawns child processes or loads Python modules from paths that were recently written by the same process
Correlate egress connections from the Applio host against an allowlist of expected model repositories

Monitoring Recommendations

Enable process and file integrity monitoring on directories consumed by Applio's model loader
Capture DNS queries from the Applio host and flag lookups for internal, metadata, or attacker-controlled domains
Log full HTTP request bodies at the reverse proxy to retain URL parameters for forensic review

How to Mitigate CVE-2025-27775

Immediate Actions Required

Restrict network access to the Applio web interface to trusted operators using a VPN or reverse proxy with authentication
Block outbound traffic from the Applio host to RFC1918 ranges, 127.0.0.0/8, and cloud metadata endpoints
Run Applio as a low-privileged user inside a container with a read-only file system for code paths

Patch Information

As of the CVE publication date, no vendor patch is available. Monitor the Applio GitHub repository and the GitHub Security Advisory for updates.

Workarounds

Disable the model download route in assets/flask/routes.py if remote downloads are not required in the deployment
Front Applio with a filtering proxy that enforces an allowlist of model repository hostnames and rejects non-HTTPS URLs
Mount model directories as read-only after provisioning known-good models to prevent write-driven code execution chains

bash

# Example egress firewall rules to block SSRF targets
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT