CVE-2026-122159 Details
Description
A weakness has been identified in Edge0-AI Audio8_TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.__init__ of the file onnx_runtime_0_1b_int8/arktts_runtime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slow_decode_models can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
A path traversal vulnerability has been identified in Edge0-AI Audio8-TTS versions prior to commit 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. The issue arises in the 0.1B INT8 ONNX runtime component, specifically within the ArkTtsRuntime.__init__ function of the runtime.py file. The vulnerability allows for manipulation of the 'slow_decode_models' argument, leading to unauthorized access of files outside the intended directory. This flaw can be exploited remotely, with the public availability of the exploit exacerbating the risk.
The vulnerability can be addressed by implementing checks that ensure ONNX model paths remain within the designated package directory, rejecting any paths that attempt to escape or are absolute. Additionally, publishing and verifying checksums for downloadable model exports would help ensure the integrity of the runtime manifest.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Edge0-AI/Audio8_TTS/ | [email protected] | Source CodeVendor |
| https://github.com/Edge0-AI/Audio8_TTS/issues/41 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/user-attachments/files/33392182/poc.zip | [email protected] | Broken LinkExploit |
| https://vuldb.com/cve/CVE-2026-122159 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1028151 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/431159 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/431159/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Edge0-AI Audio8_TTS | <= 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 5, 2026 | New CVE Received | [email protected] |