Medium severity · published Mar 5, 2026
CVE-2024-43035
Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint
5.8
CVSS
2.5%
EPSS
No
On KEV
Description
Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fonoster · Fonoster
0.5.5 before 0.6.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-43035
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-43035
github.com
https://github.com/fonoster/fonoster/blob/4a1438d9dedeaf7b2a5b6a50d5e233f994e2b2cf/mods/voice/src/utils.ts#L66-L70
zeropath.com
https://zeropath.com/blog/fonoster-voiceserver-lfi-vulnerability
More from Fonoster
4.3
CVE-2026-80209
Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler