CVE-2023-51449

Katalog CVE

CVSS 7.5 · High EPSS 28,3%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada gradio project gradio. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.

Rincian

Terbit di NVD

22 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

28,3% peluang dieksploitasi; lebih tinggi dari 98,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gradio-app/gradio/commit/1b9d4234d6c25ef250d882c7b90e1f4039ed2d76 patch
• https://github.com/gradio-app/gradio/commit/7ba8c5da45b004edd12c0460be9222f5b5f5f055 patch
• https://github.com/gradio-app/gradio/security/advisories/GHSA-6qm2-wpxq-7qh2 advisory pihak ketiga