Path Traversal Vulnerability in SoftVC VITS Singing Voice Conversion

CVE-2026-65701

What is CVE-2026-65701?

The SoftVC VITS Singing Voice Conversion product contains a path traversal vulnerability within its full-song inference server. This flaw allows unauthenticated remote attackers to exploit the system by supplying malicious filesystem paths through the 'audio_path' field in an unauthenticated POST request to the '/wav2wav' route. By leveraging this vulnerability, attackers can read and exfiltrate arbitrary files from the server. The vulnerability specifically enables attackers to pass any server-side path directly to libraries such as librosa, torchaudio, and soundfile, which may result in unauthorized file access and potential data leakage, as it allows the server to decode specified files and respond with their contents via HTTP, while also enabling the writing of malicious .wav files to predetermined locations on the server's filesystem.

References