AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

GradioGHSA-f3h9-8phc-6gvh

Gradio Path Traversal vulnerability

Gradio

CVE-2024-0964 · Published Feb 6, 2024 · updated May 19, 2026

High7.5
Fix: upgrade to 4.9.0 or later
GitHub advisory

A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.

Affected versions

PackageAffectedFixed in
gradio
PyPI
< 4.9.04.9.0
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-22
Also known as
CVE-2024-0964, PYSEC-2024-261

More Gradio advisories

All Gradio
High 7.5Apr 16, 2024gradio vulnerable to Path TraversalCVE-2024-1561fixed in 4.13.0Medium 6.5Apr 16, 2024gradio Server-Side Request Forgery vulnerabilityCVE-2024-1183fixed in 4.10.0High 7.3Mar 27, 2024gradio Server-Side Request Forgery vulnerabilityCVE-2024-2206fixed in 4.18.0Medium 5.9Feb 22, 2024Gradio apps vulnerable to timing attacks to guess passwordCVE-2024-1729fixed in 4.19.2High 8.6Dec 21, 2023Gradio makes the `/file` secure against file traversal and server-side request forgery attacksCVE-2023-51449fixed in 4.11.0Critical 9.6Dec 14, 2023Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerabilityCVE-2023-6572fixed in 4.14.0