GitHub Advisoryadvisory · PyPI

GHSA-prpg-p95c-32fv Gradio Path Traversal vulnerability

MEDIUM Published 2025-03-20 Modified 2025-03-21 Official page ↗
Aliases
CVE-2024-12217
Ecosystem
PyPI
Packages
gradio
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22, CWE-41
Reviewed
2025-03-21

Affected packages

• PyPI gradio: <= 5.0.1 (no fix yet)

Description

A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application correctly blocks access to paths like 'C:/tmp/secret.txt', it fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA'. This flaw can lead to unauthorized reading of blocked file paths.

Related

Alias · CVE (1)

  • CVE-2024-12217 A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-41 Improper Resolution of Path Equivalence weakness

References