F5-TTS EUVD-2026-33744

The F5-TTS finetune Gradio web UI (src/f5_tts/train/finetune_gradio.py, the create_data_project handler and related project-name endpoints) must be running and reachable by the attacker over the network - no authentication, user interaction, or non-default configuration toggle is required once the UI is exposed. The practical limiter is exposure: F5-TTS is typically launched ad hoc by researchers, so internet reachability requires either Gradio's share=True tunnel, a 0.0.0.0 bind, or deployment behind a permissive ingress. Impact is bounded by the filesystem permissions of the server process - if F5-TTS runs as an unprivileged user inside a container, writes are confined to that user's writable paths; if it runs as root or with broad host mounts (common on bare-metal GPU rigs), arbitrary system files become writable.

CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VI:H captures the core risk accurately: network-reachable, no authentication, no user interaction, high integrity impact, low availability impact, and no confidentiality impact (the bug writes files, it does not read them). Publicly available exploit code raises practical risk, though the vulnerability is not listed in CISA KEV and no EPSS score was provided in the input. The realistic threat is contingent on a critical deployment assumption - the Gradio finetune UI must be network-exposed; many F5-TTS installs run locally on researcher workstations, which would substantially limit blast radius. Where the UI is exposed (cloud notebooks, shared GPU servers, container deployments behind permissive ingress), this is a high-priority issue because write-anywhere primitives on ML training hosts routinely escalate to code execution via overwriting startup scripts, cron files, SSH authorized_keys, or Python site-packages.

An attacker locates an internet-exposed F5-TTS finetune Gradio interface (common on shared GPU/cloud instances or via launch(share=True) tunnels), then invokes the project-creation handler with project_name set to an absolute path such as /root/.ssh or /etc/cron.d/pwn. The server's os.makedirs() and subsequent JSON writes create the attacker-controlled directory and file at that location, and because POC code is publicly available on the GitHub issue, this can be reproduced with a single HTTP request and pivoted to code execution by dropping a cron entry or overwriting a Python module loaded by the training process.