CVE-2024-51751

Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary files from the application server. This issue has been addressed in release version 5.5.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/gradio-app/gradio/security/advisories/GHSA-rhm9-gp5p-5248	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*

History

26 Aug 2025, 16:34

Type	Values Removed	Values Added
CPE		cpe:2.3:a:gradio_project:gradio::::::python::*
First Time		Gradio Project Gradio Project gradio
References	~~() https://github.com/gradio-app/gradio/security/advisories/GHSA-rhm9-gp5p-5248 -~~	() https://github.com/gradio-app/gradio/security/advisories/GHSA-rhm9-gp5p-5248 - Exploit, Third Party Advisory

Information

Published : 2024-11-06 20:15

Updated : 2025-08-26 16:34

NVD link : CVE-2024-51751

Mitre link : CVE-2024-51751

CVE.ORG link : CVE-2024-51751

JSON object : View

Products Affected

gradio_project

gradio

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2024-51751", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-11-06T20:15:05.557", "references": [{"url": "https://github.com/gradio-app/gradio/security/advisories/GHSA-rhm9-gp5p-5248", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary files from the application server. This issue has been addressed in release version 5.5.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Gradio es un paquete Python de c\u00f3digo abierto dise\u00f1ado para permitir compilaciones r\u00e1pidas de una aplicaci\u00f3n web o de demostraci\u00f3n. Si se utilizan los componentes File o UploadButton como parte de la aplicaci\u00f3n Gradio para obtener una vista previa del contenido de un archivo, un atacante con acceso a la aplicaci\u00f3n podr\u00eda abusar de estos componentes para leer archivos arbitrarios del servidor de aplicaciones. Este problema se ha solucionado en la versi\u00f3n 5.5.0 y se recomienda a todos los usuarios que la actualicen. No se conocen workarounds para esta vulnerabilidad."}], "lastModified": "2025-08-26T16:34:42.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "B94EAA72-1E17-4B5F-9EA6-D529D6E385E2", "versionEndExcluding": "5.5.0", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}