Publish GHSA-9fv2-c7v6-p45w

Author: advisory-database[bot]

…-9fv2-c7v6-p45w/GHSA-9fv2-c7v6-p45w.json …-9fv2-c7v6-p45w/GHSA-9fv2-c7v6-p45w.jsonadvisories/unreviewed/2026/03/GHSA-9fv2-c7v6-p45w/GHSA-9fv2-c7v6-p45w.json renamed to advisories/github-reviewed/2026/03/GHSA-9fv2-c7v6-p45w/GHSA-9fv2-c7v6-p45w.json advisories/unreviewed/2026/03/GHSA-9fv2-c7v6-p45w/GHSA-9fv2-c7v6-p45w.json renamed to advisories/github-reviewed/2026/03/GHSA-9fv2-c7v6-p45w/GHSA-9fv2-c7v6-p45w.json

@@ -1,24 +1,49 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-9fv2-c7v6-p45w",
-  "modified": "2026-03-05T21:30:48Z",
+  "modified": "2026-03-06T22:46:29Z",
   "published": "2026-03-05T21:30:48Z",
   "aliases": [
     "CVE-2024-43035"
   ],
+  "summary": "Fonoster is vulnerable to directory traversal",
   "details": "Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file VoiceServer endpoint. This occurs in serveFiles in mods/voice/src/utils.ts. NOTE: serveFiles exists in 0.5.5 but not in the next release, 0.6.1.",
   "severity": [
     {
       "type": "CVSS_V3",
       "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@fonoster/voice"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.5.5"
+            },
+            {
+              "fixed": "0.6.1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43035"
     },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/fonoster/fonoster"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/fonoster/fonoster/blob/4a1438d9dedeaf7b2a5b6a50d5e233f994e2b2cf/mods/voice/src/utils.ts#L66-L70"
@@ -33,8 +58,8 @@
       "CWE-24"
     ],
     "severity": "MODERATE",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-03-06T22:46:28Z",
     "nvd_published_at": "2026-03-05T20:16:09Z"
   }
 }