CVE-2025-27781: Critical Unsafe Deserialization in Applio Inference Tab

CVE-2025-27781 is a critical (CVSS 9.8) unsafe deserialization flaw in the inference and text to speech tabs of Applio 3.2.8-bugfix and earlier. A user-supplied model file reaches torch.load, which can lead to remote code execution. A patch is on main, so update and keep the interface private.

What's affected

The record says Applio versions 3.2.8-bugfix and prior are affected. Applio is described as a voice conversion tool. The record says model_file in inference.py and in tts.py take user-supplied input, such as a path to a model, and pass it to change_choices and later to get_speakers_id. That function loads the model with torch.load in inference.py, on line 326 in 3.2.8-bugfix.

The record says a patch is available on the main branch of the repository.

This CVE is one of thirteen reported together by GitHub Security Lab in CVE-2025-27774 to CVE-2025-27786, covering unsafe deserialization, server-side request forgery, arbitrary file write, arbitrary file read and arbitrary file removal in the same project.

Severity in the record: critical, CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Weakness classes: CWE-502 (Deserialization of untrusted data).

How to check if you're exposed

Applio is a Python application, so check how you installed it.

git -C /path/to/Applio log -1 --format=%H
git -C /path/to/Applio describe --tags
pip list 2>/dev/null | grep -i applio

The record says versions 3.2.8-bugfix and prior are affected. If you track the main branch, compare your commit with the fix commits linked in Sources.

Then check exposure. Applio runs a web interface with tabs for inference, text to speech, training and model tools. Find out whether it listens on anything other than localhost and whether it sits behind a reverse proxy, a tunnel or a public share link.

For the Python packages your own projects pull in, the free in-browser scan at gold.safeguard.sh/scan reads requirements.txt.

What to do now

1. Stop exposing the Applio interface to untrusted networks. Bind it to localhost or a private network and put authentication in front of it.
2. Update to a build that includes the patch commit linked in Sources, then restart the service.
3. Do not load model files, checkpoints or paths that you did not create or verify yourself.
4. Run Applio as a low privilege user, ideally in a container or virtual machine with no access to your other files or credentials.
5. Review who can pick the model file in the inference and text to speech tabs, and limit it to people you trust.
6. Subscribe to the repository's releases and the advisory so you hear when a numbered release carries the fix.

Why it matters

Unsafe deserialization (CWE-502) means a program rebuilds an object from data that someone else controls, and the rebuilding step can run code. Python's torch.load uses pickle by default, which can execute code while reading a file. If an attacker can make the application load a file they supplied or chose, that file can act as a program. The record says this can lead to remote code execution.

The 9.8 score reflects a network attack that needs no login and no user interaction. For an AI tool, model files are a normal thing to download and share, so the habit of loading a file without thinking is common. The safe pattern is to load only weights, use a safe loading mode, and verify where files came from.

The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.

Quick check

Sources

• GitHub Security Lab advisory GHSL-2024-341 to GHSL-2024-353
• https://github.com/IAHispano/Applio/commit/eb21d9dd349a6ae1a28c440b30d306eafba65097
• Safeguard Gold entry for CVE-2025-27781

Last reviewed: 19 October 2026.