CVE-2026-112078 | RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718 webui.py change_info_ ckpt_path code injection (Issue 2866)

October 18, 2026 Yanac

A vulnerability was found in RVC-Project Retrieval-based-Voice-Conversion-WebUI up to 2.3.260718. It has been declared as critical. Impacted is the function change_info_ of the file webui.py. Executing a manipulation of the argument ckpt_path can lead to code injection.

This vulnerability is handled as CVE-2026-112078. The attack can be executed remotely. Additionally, an exploit exists.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More