CVE-2023-51449 Make the `/file` secure against file traversal attacks

2023-12-2220:58:36

CWE-22

GitHub_M

www.cve.org

cve-2023-51449

gradio

python package

vulnerability

file traversal attacks

web application

patch

5.6 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

7.9 High

AI Score

Confidence

High

0.031 Low

EPSS

Percentile

91.1%

JSON

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of gradio prior to 4.11.0 contained a vulnerability in the /file route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with share=True, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.

CNA Affected

[
  {
    "vendor": "gradio-app",
    "product": "gradio",
    "versions": [
      {
        "version": "< 4.11.0",
        "status": "affected"
      }
    ]
  }
]