{"id":"CVE-2024-43035","aliases":["EUVD-2024-55468","GHSA-9fv2-c7v6-p45w"],"status":"published","title":"Fonoster is vulnerable to directory traversal","description":"Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.","severity":{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02398,"percentile":0.84149,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-24"],"published":"2026-03-05T00:00:00Z","modified":"2026-10-28T02:31:08Z","exploits":[{"source":"pocgithub","id":"ZeroPathAI/Fonoster-LFI-PoC","title":"ZeroPathAI/Fonoster-LFI-PoC","date":"2024-08-21","url":"https://github.com/ZeroPathAI/Fonoster-LFI-PoC"}],"fixes":[{"ecosystem":"npm","package":"@fonoster/voice","fixed_in":["0.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@fonoster/voice","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.5.5"},{"fixed":"0.6.1"}]}]},{"source":"osv","ecosystem":"npm","package":"@fonoster/voice","ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.5"},{"fixed":"0.6.1"}]}]}],"products":[{"vendor":"fonoster","product":"fonoster"}],"references":[{"url":"https://github.com/fonoster/fonoster/blob/4a1438d9dedeaf7b2a5b6a50d5e233f994e2b2cf/mods/voice/src/utils.ts#L66-L70","tags":["web"]},{"url":"https://zeropath.com/blog/fonoster-voiceserver-lfi-vulnerability","tags":["article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43035","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9fv2-c7v6-p45w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43035.json","tags":["advisory"]},{"url":"https://github.com/fonoster/fonoster","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-43035","description":"Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.","status":"published","published":"2026-03-05T00:00:00Z","modified":"2026-03-06T18:20:33.64Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T14:33:58.839967Z"}],"euvd":[{"id":"EUVD-2024-55468","description":"Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.","status":"published","published":"2026-03-05T00:00:00Z","modified":"2026-03-06T18:20:33Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:07.686491Z"}],"ghsa":[{"id":"GHSA-9fv2-c7v6-p45w","title":"Fonoster is vulnerable to directory traversal","description":"Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.","status":"published","published":"2026-03-05T21:30:48Z","modified":"2026-03-06T22:46:30Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T14:39:32.329372Z"}],"nvd":[{"id":"CVE-2024-43035","description":"Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.","status":"published","published":"2026-03-05T20:16:09.88Z","modified":"2026-06-17T07:50:17.61Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T14:10:47.77313Z"}],"osv":[{"id":"CVE-2024-43035","description":"Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.","status":"published","published":"2026-03-05T00:00:00Z","modified":"2026-10-28T02:31:08.299973585Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T15:44:42.322107Z"},{"id":"GHSA-9fv2-c7v6-p45w","title":"Fonoster is vulnerable to directory traversal","description":"Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.","status":"published","published":"2026-03-05T21:30:48Z","modified":"2026-03-06T23:11:21.084245Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-24"],"updated_at":"2026-11-02T15:46:43.875515Z"}]}}