The vulnerability in fishaudio Bert-VITS2 up to commit 8f7fbd8c4770965225d258db548da27dc8dd934c involves improper handling of the data_dir argument in the generate_config function within webui_preprocess.py of the Gradio Interface. This flaw permits remote attackers to perform path traversal attacks by manipulating this argument, potentially accessing unauthorized filesystem locations. The vulnerability is publicly disclosed with no vendor response or available patch. The product lacks versioning, complicating precise identification of affected versions.

Successful exploitation of this vulnerability allows remote attackers to traverse the filesystem via the data_dir parameter, potentially accessing sensitive files outside the intended directory scope. The CVSS 4.0 score of 6.9 reflects a medium severity impact with network attack vector, no privileges or user interaction required, and low to limited confidentiality, integrity, and availability impacts. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix or workaround is available, users should consider restricting network access to the vulnerable interface and monitor for suspicious activity involving path traversal attempts. Avoid exposing the affected component to untrusted networks until a fix is released.