The flaw resides in the _get_all_models function of hiyoriUI.py inside the Bert‑VITS2 model handler. Input is improperly validated, allowing an attacker to craft a request that resolves to a file system path outside the intended directory. The vulnerability can be triggered remotely and an exploit for this flaw has already been published. Exploitation would allow an attacker to read or write arbitrary files on the host, potentially leading to execution of malicious code if critical system files are affected.

The affected product is fishaudio Bert‑VITS2, with all releases up through commit 8f7fbd8c4770965225d258db548da27dc8dd934c. No patched version has been released yet and the vendor has not responded to disclosure, so affected versions cannot be further narrowed.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. An attacker can perform a remote attack by sending a specially crafted request to the _get_all_models endpoint, likely leveraging publicly available exploit code. Because path traversal directly exposes file contents or enables file modification, the risk is high if the application runs with elevated privileges or exposes sensitive data. Monitoring for anomalous file access and ensuring proper permissions are critical.