CVE-2026-27897 Details

A critical vulnerability allowing unauthenticated remote path traversal has been identified in Vociferous versions prior to 4.4.2. The issue resides in the export_file route of src/api/system.py, where the application accepts a JSON payload with a filename and content. The API fails to validate the filename before it is processed by the backend's filesystem logic. This lack of validation, combined with an overly permissive CORS configuration, allows external attackers to bypass the intended UI file dialog. By exploiting directory traversal sequences, attackers can manipulate the application into writing arbitrary data to any location accessible by the current user's permissions. This vulnerability can lead to unauthorized access and modification of sensitive files, and in some cases, remote code execution.

To address this vulnerability, it is recommended to implement input sanitization by wrapping the filename parameter in a function that removes path information and traversal sequences. Additionally, establish API authentication requirements, such as a Bearer Token or API Key, to prevent unauthorized access. Before writing files to disk, validate the final path to ensure it does not escape the designated export directory. Finally, restrict the CORS policy to allow only trusted origins.