Skip to content
Threat Feed
Subscribe

Product

VITS Singing Voice Conversion (Through Commit 730930d)

1 brief RSS
critical advisory

CVE-2026-65701 - SoftVC VITS Singing Voice Conversion Path Traversal Vulnerability

A path traversal vulnerability exists in the full-song inference server of SoftVC VITS Singing Voice Conversion, affecting versions through commit 730930d, allowing unauthenticated remote attackers to read and exfiltrate arbitrary files by manipulating the 'audio_path' field in an unauthenticated POST request to the '/wav2wav' route.

VITS Singing Voice Conversion path-traversal file-exfiltration arbitrary-file-write web-application
1r 4t 1c