CVE-2026-8755: Bert-VITS2 Path Traversal Vulnerability

CVE-2026-8755 Overview

CVE-2026-8755 is a path traversal vulnerability [CWE-22] in fishaudio Bert-VITS2 up to commit 8f7fbd8c4770965225d258db548da27dc8dd934c. The flaw resides in the _get_all_models function within hiyoriUI.py, part of the Model Handler component. An unauthenticated remote attacker can manipulate file path inputs to traverse outside the intended model directory and access arbitrary files on the host. The exploit code has been publicly disclosed, increasing the risk of opportunistic abuse. Because Bert-VITS2 uses continuous delivery with rolling releases, no fixed version is enumerated. The vendor did not respond to disclosure attempts.

Critical Impact
Remote, unauthenticated attackers can read files outside the intended directory through the _get_all_models function, exposing application data and configuration.

Affected Products

fishaudio Bert-VITS2 up to commit 8f7fbd8c4770965225d258db548da27dc8dd934c
Component: Model Handler (hiyoriUI.py)
Function: _get_all_models

Discovery Timeline

2026-05-17 - CVE-2026-8755 published to NVD
2026-05-18 - Last updated in NVD database

Technical Details for CVE-2026-8755

Vulnerability Analysis

The vulnerability exists in the _get_all_models function of hiyoriUI.py within fishaudio Bert-VITS2. The function processes path-related input without proper sanitization, allowing attackers to inject relative path sequences such as ../ to escape the intended model directory. Because the affected interface is reachable over the network and requires no authentication or user interaction, exploitation is straightforward.

Bert-VITS2 is widely used for text-to-speech model serving, and the hiyoriUI.py component exposes a model management interface. A successful traversal grants read access to files outside the model root, including configuration files, model weights of other users, or sensitive system files readable by the service account. Public exploit code has been published as a GitHub Gist, lowering the barrier for opportunistic attackers.

Root Cause

The root cause is missing input validation and canonicalization on path inputs handled by _get_all_models. The function does not constrain resolved paths to the intended base directory, enabling directory traversal via crafted relative path segments. This is a classic [CWE-22] Improper Limitation of a Pathname to a Restricted Directory weakness.

Attack Vector

The attack is initiated remotely over the network against an exposed Bert-VITS2 hiyoriUI instance. An attacker crafts a request containing relative path traversal sequences targeting the model enumeration or retrieval endpoint backed by _get_all_models. No credentials, privileges, or user interaction are required. Public proof-of-concept code is available on a GitHub Gist, and additional technical details are tracked in VulDB Vulnerability #364382.

The vulnerability is described in prose only because no verified vendor patch code is available. Refer to the published exploit reference for technical specifics on the crafted request format.

Detection Methods for CVE-2026-8755

Indicators of Compromise

HTTP requests to hiyoriUI endpoints containing path traversal sequences such as ../, ..\, or URL-encoded variants %2e%2e%2f.
Access log entries showing model enumeration requests referencing paths outside the configured model directory.
Unexpected file read operations by the Python process hosting hiyoriUI.py targeting /etc/, user home directories, or application configuration files.

Detection Strategies

Inspect web access logs for requests to model handler routes containing traversal patterns or absolute paths.
Monitor the Bert-VITS2 service process for file open syscalls outside the declared model root using endpoint telemetry.
Deploy web application firewall rules that flag traversal sequences directed at AI model serving endpoints.

Monitoring Recommendations

Centralize Bert-VITS2 application and access logs into a SIEM and alert on path traversal signatures.
Track outbound responses from the hiyoriUI service for unusually large payloads or content that does not resemble model metadata.
Baseline expected file access patterns of the service account and alert on deviations.

How to Mitigate CVE-2026-8755

Immediate Actions Required

Restrict network exposure of the hiyoriUI interface to trusted internal networks or place it behind authenticated reverse proxies.
Run the Bert-VITS2 service under a dedicated low-privilege account with filesystem access limited to the model directory.
Apply input validation in _get_all_models to reject path inputs containing .., absolute paths, or null bytes, and canonicalize paths before use.

Patch Information

No official patch has been released. The vendor was contacted but did not respond. Bert-VITS2 uses continuous delivery with rolling releases, so administrators must apply source-level fixes manually by validating and canonicalizing path inputs in hiyoriUI.py, or pin to a known-good commit and front the service with hardening controls.

Workarounds

Deploy a reverse proxy or WAF rule that rejects request paths and query parameters containing traversal sequences.
Use OS-level sandboxing such as containers, AppArmor, or SELinux profiles to constrain the service to its model directory.
Disable or firewall the hiyoriUI endpoint in production deployments that do not require interactive model browsing.

bash

# Example nginx reverse proxy rule blocking traversal patterns
location /models/ {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e)") {
        return 403;
    }
    proxy_pass http://bert-vits2-backend;
}