CVE-2021-43831

Katalog CVE

CVSS 7.7 · High EPSS 3,9%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada gradio project gradio. Skor CVSS 3.1 7.7 (High) menurut NVD.

Deskripsi (NVD)

Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users who receive a Gradio link can access any files on the host computer if they know the file names or file paths. This is limited only by the host operating system. Paths are opened in read only mode. The problem has been patched in gradio 2.5.0.

Rincian

Terbit di NVD

15 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

3,9% peluang dieksploitasi; lebih tinggi dari 89,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gradio-app/gradio/commit/41bd3645bdb616e1248b2167ca83636a2653f781 patch · advisory pihak ketiga
• https://github.com/gradio-app/gradio/security/advisories/GHSA-rhq2-3vr9-6mcr exploit · advisory pihak ketiga