PT-2025-29678

CVE-2025-49836

Published

2025-07-15

Updated

2025-07-16

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GPT-SoVITS-WebUI versions prior to 20250228v3

Description GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. A command injection issue exists in the change label function within the webui.py file. The path list variable takes user input, which is then incorporated into a command and executed on the server, potentially allowing for arbitrary command execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Sylwia Budzynska

Sylwia-Budzynska

Vendors

Affected products

Weakness enumeration

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Related identifiers