CVE-2026-43624

Name of the Vulnerable Software and Affected Versions F5-TTS versions prior to 1.1.21

Description A path traversal issue exists in the finetune Gradio handlers. Unauthenticated attackers can write arbitrary files by providing unsanitized project names that are passed directly to the os.path.join() function without validation to ensure the resulting path remains within the intended base directory. By supplying absolute path arguments, such as /tmp/EVIL, an attacker can override the base directory and create directories containing attacker-controlled JSON content at any filesystem path writable by the server process.

Recommendations Update F5-TTS to version 1.1.21 or later.