{"id":"CVE-2024-43035","details":"Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.","aliases":["GHSA-9fv2-c7v6-p45w"],"modified":"2026-03-13T07:56:56.571808Z","published":"2026-03-05T20:16:09.880Z","references":[{"type":"WEB","url":"https://github.com/fonoster/fonoster/blob/4a1438d9dedeaf7b2a5b6a50d5e233f994e2b2cf/mods/voice/src/utils.ts#L66-L70"},{"type":"ARTICLE","url":"https://zeropath.com/blog/fonoster-voiceserver-lfi-vulnerability"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/fonoster/fonoster","events":[{"introduced":"4a1438d9dedeaf7b2a5b6a50d5e233f994e2b2cf"},{"fixed":"3ede81cb28c3a407a6c10d9763d0532773964ef3"}],"database_specific":{"versions":[{"introduced":"0.5.5"},{"fixed":"0.6.1"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43035.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}]}