GitHub Advisoryadvisory · PyPI

GHSA-pgfv-gvc5-prfg Gradio Vulnerable to Arbitrary File Deletion

HIGH Published 2025-03-20 Modified 2025-03-20 Official page ↗
Aliases
CVE-2024-10648
Ecosystem
PyPI
Packages
gradio
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-29
Reviewed
2025-03-20

Affected packages

• PyPI gradio: >= 4.0.0, <= 5.0.0b2 (no fix yet)

Description

A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset any file to an empty file, causing a denial of service (DOS) on the server.

Related

Alias · CVE (1)

  • CVE-2024-10648 A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. vulnerability

Weakness · CWE (1)

  • CWE-29 Path Traversal: '\..\filename' weakness

References