The vulnerability exists in fishaudio Bert-VITS2 up to commit 8f7fbd8c4770965225d258db548da27dc8dd934c within the _get_all_models function of hiyoriUI.py. It allows remote attackers to perform path traversal by manipulating file paths, potentially leading to unauthorized file access. The product uses continuous delivery with rolling releases, so specific affected or fixed versions are not identified. The vendor has not provided any advisory or patch information. The CVSS 4.0 vector indicates the attack is network-based, requires no privileges or user interaction, and has low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to access files outside the intended directory structure remotely. This may lead to unauthorized disclosure of sensitive information or other impacts depending on the files accessed. The CVSS score of 6.9 reflects a medium severity with partial impact on confidentiality, integrity, and availability. No confirmed exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from fishaudio. Until a patch is released, consider restricting network access to the affected service or implementing compensating controls to limit exposure to path traversal attacks.