CVE-2026-43624: F5-TTS Path Traversal Vulnerability

CVE-2026-43624 Overview

CVE-2026-43624 is a path traversal vulnerability [CWE-22] affecting F5-TTS through version 1.1.20. The flaw exists in the finetune Gradio handlers, which pass unsanitized user-supplied project names directly to os.path.join() without validating that the resulting path remains within the intended base directory. Unauthenticated remote attackers can supply absolute path arguments such as /tmp/EVIL to override the base directory entirely. This allows creation of arbitrary directories and writing of attacker-controlled JSON content at any filesystem path writable by the server process.

Critical Impact
Unauthenticated network attackers can write arbitrary files anywhere the F5-TTS server process has write access, enabling configuration tampering and potential downstream code execution.

Affected Products

F5-TTS through version 1.1.20
F5-TTS finetune_gradio.pycreate_data_project handler
Deployments exposing the F5-TTS Gradio finetune interface to untrusted networks

Discovery Timeline

2026-06-01 - CVE-2026-43624 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-43624

Vulnerability Analysis

The vulnerability resides in the F5-TTS finetune Gradio interface, specifically in handlers that build filesystem paths from user-supplied project name parameters. The code concatenates the project name with a base directory using os.path.join(). Python's os.path.join() discards earlier components when a later component is an absolute path. An attacker who supplies an absolute path like /tmp/EVIL causes the function to return that path verbatim, completely bypassing the intended base directory.

The handler then proceeds to create directories and write JSON files at the attacker-controlled location. Because the Gradio interface accepts these requests without authentication, any network-reachable instance is exposed. Successful exploitation can result in overwriting application configuration, dropping files into web roots, or staging payloads consumed by other privileged processes.

Root Cause

The root cause is missing path normalization and containment validation [CWE-22]. The code does not call os.path.realpath() followed by a check that the resolved path begins with the canonical base directory. It also does not reject project names containing path separators or absolute path prefixes. Trust is placed in user input that should be treated as untrusted.

Attack Vector

The attack is exploitable over the network with low complexity and requires no authentication or user interaction. An attacker submits a crafted request to the Gradio endpoint exposed by finetune_gradio.py, setting the project name field to an absolute path. The server then creates the attacker-specified directory and writes JSON content controlled by request parameters. Refer to the VulnCheck Security Advisory and the upstream GitHub Issue Report for technical details.

Detection Methods for CVE-2026-43624

Indicators of Compromise

Unexpected directories created under filesystem roots such as /tmp/, /var/, or application working directories with JSON files matching F5-TTS project metadata schemas
Gradio access logs showing requests to create_data_project with project name values containing /, \, .., or absolute path prefixes
New or modified files in sensitive locations owned by the user running the F5-TTS process

Detection Strategies

Inspect HTTP request bodies sent to the F5-TTS Gradio backend for project name parameters that begin with /, ~, or drive letters
Audit filesystem activity by the F5-TTS service account, alerting on writes outside the configured project base directory
Compare current F5-TTS source against the patched commit 2f53ded68e5f69e248ceb200a51ef4d1dc647936 to confirm whether the fix is applied

Monitoring Recommendations

Enable verbose logging on the Gradio application and forward logs to a centralized analytics platform for retention and correlation
Monitor process file write syscalls using auditd or eBPF tooling, focusing on paths outside the F5-TTS project directory
Alert on outbound connections or shell invocations originating from the Python process serving Gradio after suspicious write events

How to Mitigate CVE-2026-43624

Immediate Actions Required

Upgrade F5-TTS to a version that includes the fix from GitHub Pull Request 1294 and commit 2f53ded
Restrict network access to the Gradio finetune interface so it is reachable only from trusted administrative hosts
Run the F5-TTS process under a low-privilege account with write access limited to its project directory

Patch Information

The upstream maintainers addressed the issue in commit 2f53ded68e5f69e248ceb200a51ef4d1dc647936, merged via pull request 1294. The patch validates that the resolved project path remains within the configured base directory before performing any filesystem operations. Operators should rebuild and redeploy from a patched revision and verify the fix by attempting to submit an absolute path as a project name.

Workarounds

Place the Gradio interface behind an authenticated reverse proxy that enforces access controls and rate limits
Deploy the application inside a container or sandbox with a read-only root filesystem and a tightly scoped writable volume
Add an input filter or web application firewall rule that rejects project name parameters containing path separators or absolute path prefixes

bash

# Configuration example: restrict Gradio exposure with a systemd sandbox
# /etc/systemd/system/f5-tts.service.d/hardening.conf
[Service]
ProtectSystem=strict
ProtectHome=true
ReadWritePaths=/var/lib/f5-tts/projects
NoNewPrivileges=true
PrivateTmp=true