CVE-2024-51751 MEDIUM

CVE-2024-51751: Arbitrary file read with File and UploadButton components in Gradio

Vendor Gradio-App
Product gradio
Weakness CWE-22 · Path traversal
Published November 6, 2024
Last update November 6, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary files from the application server. This issue has been addressed in release version 5.5.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Key dates

02Disclosure timeline

November 6, 2024 CVE published
November 6, 2024 Record updated