{"action":"Upgrade @fonoster/voice to 0.6.1 or later.","affected":[{"fixed":"0.6.1","introduced":"0.5.5"}],"component":"@fonoster/voice","cve_ids":["CVE-2024-43035"],"ecosystem":"npm","epss":0.02507,"exploited":false,"fixed_versions":["0.6.1"],"ghsa_id":"GHSA-9fv2-c7v6-p45w","id":"tcs_01M5KFFR0ESMC53WB1CXJMV3A0","modified_at":"2026-03-06T23:11:21.084245Z","published_at":"2026-03-05T21:30:48Z","references":["https://osv.dev/vulnerability/GHSA-9fv2-c7v6-p45w","https://nvd.nist.gov/vuln/detail/CVE-2024-43035","https://github.com/fonoster/fonoster","https://github.com/fonoster/fonoster/blob/4a1438d9dedeaf7b2a5b6a50d5e233f994e2b2cf/mods/voice/src/utils.ts#L66-L70","https://zeropath.com/blog/fonoster-voiceserver-lfi-vulnerability"],"severity":{"label":"medium","score":5.8},"sources":[{"source":"osv","source_id":"GHSA-9fv2-c7v6-p45w","url":"https://osv.dev/vulnerability/GHSA-9fv2-c7v6-p45w"}],"summary":"Fonoster is vulnerable to directory traversal"}