GHSA-9fv2-c7v6-p45wMediumCVSS 5.8

Fonoster is vulnerable to directory traversal

Published
March 5, 2026
Last Modified
March 6, 2026

🔗 CVE IDs covered (1)

CVE-2024-43035 →

📋 Description

Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.

🎯 Affected products1

  • npm/@fonoster/voice:>= 0.5.5, < 0.6.1

🔗 References (4)