Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
F5-TTS through version 1.1.20 contains a path traversal vulnerability in the finetune Gradio handlers that allows unauthenticated attackers to write arbitrary files by passing unsanitized user-supplied project names directly to os.path.join() without validating the resulting path stays within the intended base directory. Attackers can supply absolute path arguments such as /tmp/EVIL to override the base directory entirely and create arbitrary directories with attacker-controlled JSON content at any filesystem path writable by the server process.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
🚨 HIGH SEVERITY: CVE-2026-43624 (CVSS 8.2) F5-TTS ≤1.1.20 path traversal flaw allows unauthenticated attackers to write arbitrary files via unsanitized project names in Gradio handlers. Patch immediately. #CVE #Vulnerability #PatchNow #ThreatIntel #CyberSecurity https://t.co/dpdQCQAxuO
Post summary
The tweet announces the CVE-2026-43624 path traversal vulnerability and urges immediate patching.