CVE-2026-112078

EUVD-2026-104066
A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection. The attack can be executed remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 14.75%
Common Weakness Enumeration
References
https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/
https://github.com/RVC-Project/Retrieval-based-Voice-Conversion-WebUI/issues/2866
https://github.com/user-attachments/files/32909432/rvc-train-log-eval-poc.zip
https://vuldb.com/cve/CVE-2026-112078
https://vuldb.com/submit/1009621
https://vuldb.com/vuln/421757
https://vuldb.com/vuln/421757/cti