CVE-2026-112078 Overview
CVE-2026-112078 is a code injection vulnerability [CWE-74] in the RVC-Project Retrieval-based-Voice-Conversion-WebUI, affecting versions up to 2.3.260718. The flaw resides in the change_info_ function within webui.py. An attacker can manipulate the ckpt_path argument to inject and execute arbitrary code. The attack can be launched remotely and requires user interaction. A public exploit has been released, and the project maintainers have not yet responded to the issue report filed against the repository.
Critical Impact
Remote attackers can inject code through the ckpt_path parameter of the change_info_ function, compromising the confidentiality, integrity, and availability of systems running the vulnerable WebUI.
Affected Products
- RVC-Project Retrieval-based-Voice-Conversion-WebUI versions up to and including 2.3.260718
- Deployments exposing the WebUI interface over a network
- Systems where the WebUI accepts user-supplied checkpoint paths
Discovery Timeline
- 2026-10-19 - CVE-2026-112078 published to the National Vulnerability Database (NVD)
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-112078
Vulnerability Analysis
The vulnerability affects the change_info_ function defined in webui.py of the RVC-Project Retrieval-based-Voice-Conversion-WebUI. The function accepts a ckpt_path argument from user input without proper validation or sanitization. An attacker who supplies a crafted value for ckpt_path can inject code that is interpreted and executed by the WebUI process. Because the WebUI is network-accessible, exploitation does not require local access to the host. The exploit has been published, which lowers the barrier for opportunistic attacks against exposed instances.
Root Cause
The root cause is improper neutralization of input used in a downstream component [CWE-74]. The change_info_ function treats the ckpt_path argument as trusted and passes it into a context that performs dynamic evaluation or path handling without first validating the content. This allows an attacker to break out of the expected input format and introduce executable payloads.
Attack Vector
Exploitation occurs over the network against the exposed WebUI. The attacker submits a manipulated ckpt_path value through the interface that handles checkpoint selection or training log evaluation. User interaction is required to trigger the vulnerable code path, consistent with the published proof-of-concept flow. Successful exploitation yields code execution in the context of the WebUI process. Technical details and a reproduction archive are available in the GitHub Issue #2866 Discussion and the RVC Training Log Evaluation PoC.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-112078
Indicators of Compromise
- Unexpected child processes spawned by the Python interpreter running webui.py
- Outbound network connections initiated from the WebUI process to unknown hosts
- Unusual values submitted to the ckpt_path parameter containing shell metacharacters, Python code fragments, or path traversal sequences
- Modified or newly created files in the WebUI working directory outside normal checkpoint operations
Detection Strategies
- Inspect WebUI request logs for ckpt_path values that deviate from expected filename patterns
- Monitor process trees for the WebUI Python process spawning shells, interpreters, or reconnaissance utilities
- Alert on filesystem writes by the WebUI process outside designated model and log directories
Monitoring Recommendations
- Enable verbose application logging around the change_info_ function and ship logs to a central platform
- Correlate WebUI access logs with endpoint process telemetry to identify exploitation chains
- Track network egress from hosts running the WebUI and baseline normal destinations
How to Mitigate CVE-2026-112078
Immediate Actions Required
- Restrict network exposure of the WebUI to trusted networks only, and place it behind authenticated reverse proxies
- Disable the WebUI on hosts where it is not actively required
- Review access logs for prior requests containing suspicious ckpt_path values and investigate affected hosts
- Run the WebUI as a non-privileged user inside an isolated container or virtual environment
Patch Information
No vendor patch is available at the time of publication. The project was notified through an issue report filed against the GitHub RVC Project Repository but has not yet responded. Monitor the GitHub Issue #2866 Discussion and the VulDB CVE-2026-112078 Entry for updates.
Workarounds
- Block external access to the WebUI port using host firewall rules or network ACLs
- Require authentication at a reverse proxy layer before any request reaches the WebUI
- Validate and allowlist ckpt_path values at the proxy or application layer, rejecting any input containing shell metacharacters or path separators outside the expected checkpoint directory
- Run the service inside a sandbox or container with read-only filesystems and no outbound internet access
# Example: restrict WebUI access to localhost only via iptables
iptables -A INPUT -p tcp --dport 7865 ! -s 127.0.0.1 -j DROP
iptables -A INPUT -p tcp --dport 7865 -s 127.0.0.1 -j ACCEPT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
