Applio allows arbitrary file write in inference.py
Applio 3.2.7 contains a vulnerability in inference.py that allows arbitrary file writes, as part of a series of 13 security issues including unsafe deserialization and server-side request forgery vulnerabilities reported to the GitHub Security Lab.
What happened
Applio version 3.2.7 is vulnerable to arbitrary file writes through multiple endpoints that accept user-supplied URLs and download files without proper validation.
Similar vulnerabilities exist in model_download.py where HTTP requests made to arbitrary destinations are used to download and write files to the server using unsafe file operations.
Reported impact
The arbitrary file write vulnerability can be coupled with other vulnerabilities, such as unsafe deserialization issues, to achieve remote code execution on the Applio server.
The file write capability allows attackers to write files to the server, potentially enabling code execution when combined with other exploitation techniques.
Index analysis
The vulnerability was discovered as part of a coordinated disclosure process by GitHub Security Lab, which identified 13 distinct vulnerabilities in Applio including CVE-2025-27774 through CVE-2025-27786.
Governance controls
The maintainers of Applio were notified on 2024-12-11 via a private vulnerability report. After multiple follow-ups and a 90-day disclosure deadline, details were published on 2025-03-10.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.