This vulnerability exists in fishaudio Bert-VITS2 up to commit 8f7fbd8c4770965225d258db548da27dc8dd934c. The generate_config function in webui_preprocess.py improperly handles the data_dir argument, enabling path traversal attacks. This can be exploited remotely without authentication or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) indicating network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. No official patch or remediation guidance is available as the vendor has not responded to disclosure.

Successful exploitation allows remote attackers to perform path traversal, potentially accessing or manipulating files outside the intended directory scope. This could lead to unauthorized disclosure or modification of files. The impact is rated medium severity based on CVSS 4.0 scoring. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing network-level protections such as restricting access to the vulnerable interface and monitoring for suspicious input patterns targeting the data_dir parameter. Avoid exposing the vulnerable component to untrusted networks until a fix is available.