AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

GradioGHSA-v4q9-qgqf-7jwp

Gradio arbitrary file upload vulnerability

Gradio

CVE-2023-41626 · Published Sep 16, 2023 · updated Jul 7, 2026

Medium4.8
No fix yet
GitHub advisory

Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface.

Affected versions

PackageAffectedFixed in
gradio
PyPI
<= 3.27.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-434
Also known as
CVE-2023-41626, PYSEC-2026-1422

More Gradio advisories

All Gradio
High 7.3Mar 27, 2024gradio Server-Side Request Forgery vulnerabilityCVE-2024-2206fixed in 4.18.0Medium 5.9Feb 22, 2024Gradio apps vulnerable to timing attacks to guess passwordCVE-2024-1729fixed in 4.19.2High 7.5Feb 6, 2024Gradio Path Traversal vulnerabilityCVE-2024-0964fixed in 4.9.0High 8.6Dec 21, 2023Gradio makes the `/file` secure against file traversal and server-side request forgery attacksCVE-2023-51449fixed in 4.11.0Critical 9.6Dec 14, 2023Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerabilityCVE-2023-6572fixed in 4.14.0Medium 7.3Jun 9, 2023Gradio vulnerable to arbitrary file read and proxying of arbitrary URLsCVE-2023-34239fixed in 3.34.0