# CVE-2026-122159: Edge0-AI Audio8_TTS Model Path Resolution runtime.py ArkTtsRuntime.__init__ path traversal

Status: published. Published: 2026-11-05. Updated: 2026-11-05.

A weakness has been identified in Edge0-AI Audio8_TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.__init__ of the file onnx_runtime_0_1b_int8/arktts_runtime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slow_decode_models can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Edge0-AI / Audio8_TTS: 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6 (affected). Source: CNA: VulDB

## Severity and prioritization

- CVSS 4.0: 5.3 (medium); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P; source: CNA: VulDB

- CVSS 3.1: 6.3 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C; source: CNA: VulDB

- CVSS 3.0: 6.3 (medium); CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C; source: CNA: VulDB

- CVSS 2.0: 7.5 (high); AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C; source: CNA: VulDB

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-22

## Exploit evidence

- exploit: https://github.com/user-attachments/files/33392182/poc.zip (CNA: VulDB)

## References

- https://vuldb.com/vuln/431159 (CNA: VulDB; vdb-entry, technical-description)

- https://vuldb.com/vuln/431159/cti (CNA: VulDB; signature, permissions-required)

- https://vuldb.com/cve/CVE-2026-122159 (CNA: VulDB; third-party-advisory)

- https://vuldb.com/submit/1028151 (CNA: VulDB; third-party-advisory)

- https://github.com/Edge0-AI/Audio8_TTS/issues/41 (CNA: VulDB; issue-tracking)

- https://github.com/user-attachments/files/33392182/poc.zip (CNA: VulDB; exploit)

- https://github.com/Edge0-AI/Audio8_TTS/ (CNA: VulDB; product)

## Provenance

- CNA: VulDB: https://www.cve.org/CVERecord?id=CVE-2026-122159; retrieved 2026-11-05; source updated 2026-11-05

Revision: d851dbb54c154bee18d2127f064699c287b204b9c6bb14d9d727ee8972cff2bf

Canonical: https://y2.dev/cve/CVE-2026-122159

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.