Which versions of F5-TTS are affected by CVE-2026-43624?

F5-TTS versions through 1.1.20 contain an unauthenticated arbitrary file write vulnerability (CVSS 8.8) with publicly available exploit code.. A patch is available.

Is there a public PoC exploit available for CVE-2026-43624?

Yes, a public proof-of-concept exploit is available for CVE-2026-43624. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-43624?

Within 24 hours: Identify all F5-TTS instances running version 1.1.20 or earlier and restrict network access to trusted networks only. Within 7 days: Apply the vendor patch released via PR #1294 (confirm exact patched version with F5 documentation and upgrade all affected instances). Within 30 days: Verify patch deployment across all systems and conduct log review for exploitation indicators.

F5-TTS CVE-2026-43624

Q: What is the CVSS score of CVE-2026-43624?

CVE-2026-43624 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33744 HIGH

Path Traversal (CWE-22)

2026-06-01 VulnCheck

GHSA-93wx-x4m2-5c8f

Path Traversal F5 Tts

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 01, 2026 - 19:24 vuln.today

Analysis Generated

Jun 01, 2026 - 19:24 vuln.today

CVSS changed

Jun 01, 2026 - 19:22 NVD

8.2 (HIGH) 8.8 (HIGH)

DescriptionCVE.org

F5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows unauthenticated attackers to write arbitrary files by passing unsanitized user-supplied project names directly to os.path.join() without validating the resulting path stays within the intended base directory. Attackers can supply absolute path arguments such as /tmp/EVIL to override the base directory entirely and create arbitrary directories with attacker-controlled JSON content at any filesystem path writable by the server process.

AnalysisAI

Arbitrary file write in F5-TTS through 1.1.20 allows unauthenticated remote attackers to create directories and write attacker-controlled JSON anywhere the server process has write access by abusing unsanitized project_name parameters in the finetune Gradio interface. The flaw stems from passing user input directly to os.path.join() - supplying an absolute path bypasses the intended base directory entirely. Publicly available exploit code exists, and an upstream patch has been merged via PR #1294.

Technical ContextAI

F5-TTS is an open-source flow-matching text-to-speech model (vendor: SWivid) that ships a Gradio-based web UI for fine-tuning (src/f5_tts/train/finetune_gradio.py). The vulnerability is a textbook CWE-22 Path Traversal: Python's os.path.join(base, user_input) returns user_input unchanged when user_input is absolute (e.g. '/tmp/EVIL'), silently discarding the base directory. Multiple handlers - save_settings, start_training, get_list_projects, vocab_extend, vocab_check, get_random_sample_prepare, calculate_train - all consumed project_name/dataset_name from Gradio inputs without normalization or containment checks, causing every downstream os.makedirs() and file write to follow the attacker's path. The CPE confirms affected scope is swivid:f5-tts across all versions up to 1.1.20.

RemediationAI

Upstream fix available (PR https://github.com/SWivid/F5-TTS/pull/1294 and commit https://github.com/SWivid/F5-TTS/commit/2f53ded68e5f69e248ceb200a51ef4d1dc647936); a released patched version was not independently confirmed in the input data, so users should pin to a build that includes that commit or apply the patch manually until SWivid tags a release above 1.1.20. The fix introduces _safe_project_path(), which rejects absolute paths, null bytes, and '.'/'..' components and verifies via os.path.realpath that the resolved path remains under the intended base directory. As compensating controls until the patch is deployed, bind the Gradio app to 127.0.0.1 only (Gradio defaults to local but launch(share=True) and many container configs expose 0.0.0.0), place the finetune UI behind authenticated reverse-proxy access (HTTP basic auth or SSO), and run the server process as an unprivileged account inside a container with a read-only root filesystem so that arbitrary writes cannot reach /etc, ~/.ssh, or Python site-packages - be aware this last control will break legitimate writes outside the project directory and may require explicit writable volume mounts.