CVE-2024-1561

Katalog CVE

CVSS 7.5 · High EPSS 9,3%

Kerentanan Path Traversal: '\..\filename' pada gradio project gradio. Skor CVSS 3.0 7.5 (High) menurut huntr.dev.

Deskripsi (NVD)

An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any method on a `Component` class with attacker-controlled arguments. Specifically, by exploiting the `move_resource_to_block_cache()` method of the `Block` class, an attacker can copy any file on the filesystem to a temporary directory and subsequently retrieve it. This vulnerability enables unauthorized local file read access, posing a significant risk especially when the application is exposed to the internet via `launch(share=True)`, thereby allowing remote attackers to read files on the host machine. Furthermore, gradio apps hosted on `huggingface.co` are also affected, potentially leading to the exposure of sensitive information such as API keys and credentials stored in environment variables.

Rincian

Terbit di NVD

16 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

7.5 (High), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-29: Path Traversal: '\..\filename'

EPSS (30 hari)

9,3% peluang dieksploitasi; lebih tinggi dari 95,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gradio-app/gradio/commit/24a583688046867ca8b8b02959c441818bdb34a2 patch
• https://huntr.com/bounties/4acf584e-2fe8-490e-878d-2d9bf2698338 exploit · advisory pihak ketiga
• https://www.gradio.app/changelog#4-13-0 release notes