{"id":"CVE-2024-32944","aliases":["EUVD-2024-34470"],"status":"published","description":"Path traversal vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product installs a crafted UTAU voicebank installer (.uar file, .zip file) to UTAU, an arbitrary file may be placed.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00195,"percentile":0.09308,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2024-05-28T03:11:04Z","modified":"2026-06-17T07:30:44Z","products":[{"vendor":"ameya/ayame","product":"utau"}],"references":[{"url":"https://utau2008.xrea.jp/","tags":["x_transferred"]},{"url":"https://jvn.jp/en/jp/JVN71404925/","tags":["x_transferred"]}],"sources":{"cve":[{"id":"CVE-2024-32944","description":"Path traversal vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product installs a crafted UTAU voicebank installer (.uar file, .zip file) to UTAU, an arbitrary file may be placed.","status":"published","published":"2024-05-28T03:11:04.472Z","modified":"2024-10-29T14:51:18.432Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:34:16.007021Z"}],"euvd":[{"id":"EUVD-2024-34470","description":"Path traversal vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product installs a crafted UTAU voicebank installer (.uar file, .zip file) to UTAU, an arbitrary file may be placed.","status":"published","published":"2024-05-28T03:11:04Z","modified":"2024-10-29T14:51:18Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T00:05:15.24326Z"}],"nvd":[{"id":"CVE-2024-32944","description":"Path traversal vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product installs a crafted UTAU voicebank installer (.uar file, .zip file) to UTAU, an arbitrary file may be placed.","status":"published","published":"2024-05-28T03:15:08.563Z","modified":"2026-06-17T07:30:44.883Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:10:02.520903Z"}]}}