https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T05:04:39.909882+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274844 EUVD-2026-274844 2026-10-06T05:04:39.957670+00:00 EUVD-2026-274844 https://cve.radiocsirt.org/vuln/fkie_cve-2024-43035 fkie_cve-2024-43035 2026-10-06T05:04:39.957708+00:00

Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.

 https://cve.radiocsirt.org/vuln/ghsa-9fv2-c7v6-p45w GHSA-9fv2-c7v6-p45w — Fonoster is vulnerable to directory traversal 2026-10-06T05:04:39.957743+00:00

Affected: npm: @fonoster/voice

Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.