Path Traversal Vulnerability in Edge0-AI Audio8_TTS Exploiting Model Path Resolution
CVE-2026-122159

5.3MEDIUM

Key Information:

Vendor

Edge0-ai

Status
Audio8 Tts
Vendor
CVE Published:
5 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-122159?

A vulnerability has been discovered in the Edge0-AI Audio8_TTS product, specifically within the Model Path Resolution component. The weakness originates from the ArkTtsRuntime.init function in the runtime.py file, which allows attackers to manipulate the 'slow_decode_models' argument. This manipulation can lead to unauthorized file access through path traversal techniques, potentially enabling remote exploitation. Despite informing the project of this issue early, there has been no response from the maintainers regarding updates or mitigations. The product follows a rolling release model, meaning detailed version information for the affected releases is not disclosed.

Affected Version(s)

Audio8_TTS 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-122159 - Proof of Concept

References

https://vuldb.com/vuln/431159
vdb-entrytechnical-description
https://vuldb.com/vuln/431159/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-122159
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dem000000 (VulDB User)
VulDB CNA Team
.