CVE-2026-8756: fishaudio Bert-VITS2 Path Traversal Vulnerability Publicly Disclosed
The National Vulnerability Database has detailed CVE-2026-8756, a high-severity path traversal vulnerability impacting fishaudio Bert-VITS2, specifically versions up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The flaw resides within the generate_config function in the webui_preprocess.py file, part of the Gradio Interface component. Attackers can remotely manipulate the data_dir argument to achieve path traversal.
This vulnerability carries a CVSSv3.1 score of 7.3 (HIGH), indicating significant risk. Crucially, the exploit code has been publicly disclosed, raising the immediate threat level for unpatched instances. The National Vulnerability Database notes that fishaudio Bert-VITS2 does not use versioning, which complicates identifying affected and unaffected releases. Attempts to contact the vendor about the disclosure reportedly received no response.
Path traversal vulnerabilities are not theoretical; they allow attackers to access arbitrary files and directories on the server, potentially leading to information disclosure, unauthorized file modification, or even remote code execution if combined with other weaknesses. Given the public exploit and lack of vendor response, defenders must assume active exploitation is imminent.
What This Means For You
- If your organization utilizes fishaudio Bert-VITS2, you are directly exposed to CVE-2026-8756. The public exploit disclosure means this isn't a theoretical risk – it's an immediate threat. Identify all instances of Bert-VITS2, assess their exposure, and if a patch isn't available, consider isolating or removing the service until a fix is released. This is a critical path to data compromise.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-8756: Bert-VITS2 Path Traversal in Gradio Interface
title: CVE-2026-8756: Bert-VITS2 Path Traversal in Gradio Interface
id: scw-2026-05-17-ai-1
status: experimental
level: high
description: |
Detects attempts to exploit the CVE-2026-8756 vulnerability in fishaudio Bert-VITS2. This rule specifically looks for path traversal sequences within the URI and query parameters, targeting the 'data_dir' argument in the Gradio Interface's generate_config function. The presence of encoded or direct path traversal characters ('..%252F', '..%255C', '../', '..\') in these fields indicates a potential exploit attempt.
author: SCW Feed Engine (AI-generated)
date: 2026-05-17
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-8756/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/..%252F'
- '/..%255C'
- '/../'
- '/..\'
cs-uri-query|contains:
- 'data_dir=..%252F'
- 'data_dir=..%255C'
- 'data_dir=../'
- 'data_dir=..\'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-8756 | Path Traversal | fishaudio Bert-VITS2 up to commit 8f7fbd8c4770965225d258db548da27dc8dd934c |
| CVE-2026-8756 | Path Traversal | Vulnerable function: generate_config in webui_preprocess.py |
| CVE-2026-8756 | Path Traversal | Vulnerable component: Gradio Interface |
| CVE-2026-8756 | Path Traversal | Vulnerable argument: data_dir |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 17, 2026 at 16:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-20240 — Denial of Service
CVE-2026-20240 — In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21, 10.0.2503.13, and 9.3.2411.129,...
Splunk Enterprise, Cloud Vulnerability Exposes Session Cookies, Sensitive Data
CVE-2026-20239 — In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a...
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged
CVE-2026-20238 — In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data...