{"id":"GHSA-9fv2-c7v6-p45w","summary":"Fonoster is vulnerable to directory traversal","details":"Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.","aliases":["CVE-2024-43035"],"modified":"2026-03-06T23:01:28.520160Z","published":"2026-03-05T21:30:48Z","database_specific":{"github_reviewed_at":"2026-03-06T22:46:28Z","severity":"MODERATE","nvd_published_at":"2026-03-05T20:16:09Z","cwe_ids":["CWE-24"],"github_reviewed":true},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43035"},{"type":"PACKAGE","url":"https://github.com/fonoster/fonoster"},{"type":"WEB","url":"https://github.com/fonoster/fonoster/blob/4a1438d9dedeaf7b2a5b6a50d5e233f994e2b2cf/mods/voice/src/utils.ts#L66-L70"},{"type":"WEB","url":"https://zeropath.com/blog/fonoster-voiceserver-lfi-vulnerability"}],"affected":[{"package":{"name":"@fonoster/voice","ecosystem":"npm","purl":"pkg:npm/%40fonoster/voice"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.5.5"},{"fixed":"0.6.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-9fv2-c7v6-p45w/GHSA-9fv2-c7v6-p45w.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"}]}