{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-04T19:34:17.912","vulnerabilities":[{"cve":{"id":"CVE-2024-43035","sourceIdentifier":"cve@mitre.org","published":"2026-03-05T20:16:09.880","lastModified":"2026-06-17T07:50:17.610","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1."},{"lang":"es","value":"Fonoster 0.5.5 anterior a 0.6.1 permite el salto de directorio ../ para leer archivos arbitrarios a través del endpoint VoiceServer /sounds/:file o /tts/:file. Esto ocurre en serveFiles en mods/voice/src/utils.ts. NOTA: serveFiles existe en 0.5.5 pero no en la siguiente versión, 0.6.1."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Fonoster","product":"Fonoster","defaultStatus":"unknown","versions":[{"version":"0.5.5","lessThan":"0.6.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","baseScore":5.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-06T18:20:27.912948Z","id":"CVE-2024-43035","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-24"}]}],"references":[{"url":"https://github.com/fonoster/fonoster/blob/4a1438d9dedeaf7b2a5b6a50d5e233f994e2b2cf/mods/voice/src/utils.ts#L66-L70","source":"cve@mitre.org"},{"url":"https://zeropath.com/blog/fonoster-voiceserver-lfi-vulnerability","source":"cve@mitre.org"}]}}]}