CVE-2026-27897 Vociferous Unauthenticated Remote Path Traversal (RCE via CSRF)
Unauthenticated attackers can exploit path traversal in the export API to write arbitrary files, potentially achieving remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27897?
CVE-2026-27897 is a critical path traversal vulnerability in WanderingAstronomer Vociferous, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vociferous provides cross-platform, offline speech-to-text with local AI refinement. Prior to 4.4.2, the vulnerability exists in src/api/system.py within the export_file route. The application accepts a JSON payload containing a filename and content. While the developer intended for a native UI dialog to handle the file path, the API does not validate the filename string before it is processed by the backends filesystem logic. Because the API is unauthenticated and the CORS configuration in app.py is overly permissive (allow_origins=["*"] or allowing localhost), an external attacker can bypass the UI entirely. By using directory traversal sequences (../), an attacker can force the app to write arbitrary data to any location accessible by the current user's permissions. This vulnerability is fixed in 4.4.2.
Which versions are affected by CVE-2026-27897?
It affects 1 product.
Products include Wanderingastronomer Vociferous.
How do I fix CVE-2026-27897?
No fix has been published for CVE-2026-27897 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-27897 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27897 exists.