CVE-2022-4880

CRITICAL 9.8CVE-2022-4880 · Published 07/01/2023 · updated 17/06/2026

In short

CVE-2022-4880 is a CRITICAL (CVSS 9.8) vulnerability affecting openutau (openutau).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.2% of all vulnerabilities.
Fix: update to 0.0.991 or later.

Package	Affected versions	Patched versions
openutau openutau	`< 0.0.991`	`0.0.991`

Description

A vulnerability was found in stakira OpenUtau. It has been classified as critical. This affects the function VoicebankInstaller of the file OpenUtau.Core/Classic/VoicebankInstaller.cs of the component ZIP Archive Handler. The manipulation leads to path traversal. Upgrading to version 0.0.991 is able to address this issue. The identifier of the patch is 849a0a6912aac8b1c28cc32aa1132a3140caff4a. It is recommended to upgrade the affected component. The identifier VDB-217617 was assigned to this vulnerability.

References

stakira/OpenUtau commit 849a0a6 · Patch
stakira/OpenUtau#544 · Patch
stakira/OpenUtau release build/0.0.991 · Release Notes
vuldb.com · Permissions Required
vuldb.com · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free