CVE-2024-43035: Fonoster is vulnerable to directory traversal

March 5, 2026 (updated March 6, 2026)

Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.

References

github.com/advisories/GHSA-9fv2-c7v6-p45w
github.com/fonoster/fonoster
github.com/fonoster/fonoster/blob/4a1438d9dedeaf7b2a5b6a50d5e233f994e2b2cf/mods/voice/src/utils.ts
nvd.nist.gov/vuln/detail/CVE-2024-43035
zeropath.com/blog/fonoster-voiceserver-lfi-vulnerability

Code Behaviors & Features

Detect and mitigate CVE-2024-43035 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →