CVE-2022-4880mediumCWE-22

CVE-2022-4880: medium-severity vulnerability in stakira OpenUtau

stakira OpenUtau ZIP Archive VoicebankInstaller.cs VoicebankInstaller path traversal

Published 07 Jan 2023 · Updated 03 Aug 2024

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.5epss 1.1%

A vulnerability was found in stakira OpenUtau. It has been classified as critical. This affects the function VoicebankInstaller of the file OpenUtau.Core/Classic/VoicebankInstaller.cs of the component ZIP Archive Handler. The manipulation leads to path traversal. Upgrading to version 0.0.991 is able to address this issue. The identifier of the patch is 849a0a6912aac8b1c28cc32aa1132a3140caff4a. It is recommended to upgrade the affected component. The identifier VDB-217617 was assigned to this vulnerability.

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected products

stakira · OpenUtau

References

https://github.com/stakira/OpenUtau/commit/849a0a6912aac8b1c28cc32aa1132a3140caff4a https://github.com/stakira/OpenUtau/pull/544 https://github.com/stakira/OpenUtau/releases/tag/build%2F0.0.991 https://vuldb.com/?ctiid.217617 https://vuldb.com/?id.217617