GradioGHSA-pgfv-gvc5-prfg
Gradio Vulnerable to Arbitrary File Deletion
No fix yet
A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset any file to an empty file, causing a denial of service (DOS) on the server.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| gradio PyPI | >= 4.0.0, <= 5.0.0b2 | No fix yet |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-29
- Also known as
- CVE-2024-10648, PYSEC-2026-1417