PrivacyHigh
CVE-2023-51449: Gradio is an open-source Python package that allows you to quickly build a demo or web application f…
- Occurred
- Dec 22, 2023
- Published
- Dec 22, 2023
- Source
- NVD CVE
Summary
Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.
Tags
- CVE
- CVE-2023-51449
- cvss:MEDIUM
Classification
Category confidence: 90%
Severity confidence: 90%
Rationale: Vulnerability allows unauthorized file access on public Gradio apps, constituting a privacy breach and data exposure risk.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8