The vulnerability lies in the generate_config function of fishaudio Bert-VITS2’s Gradio webui_preprocess.py. An attacker can manipulate the data_dir argument to perform a path traversal, as identified by CWE-22. The description indicates that the attack can be launched remotely. At the time of disclosure the product did not publish specific version numbers, but the description indicates all releases before commit 8f7fbd8c4770965225d258db548da27dc8dd934c are impacted.

All installations of fishaudio Bert-VITS2 that incorporate the Gradio Interface component and have not been updated to a commit containing the fix (identified as 8f7fbd8c4770965225d258db548da27dc8dd934c). The vendor does not provide an official release list, and no versioning information is available.

With a CVSS base score of 6.9 the vulnerability is considered moderate. The EPSS score is not available, and it is not listed in the CISA KEV catalog. The public disclosure and the statement that the attack can be launched remotely indicate that the risk remains significant, although the description does not specify the exact capabilities an attacker could derive. Therefore, the analysis refrains from claiming arbitrary file read/write or other specific impacts.