CVE-2024-1728High· 8.1▾ MidnightPoC availableGradio allows users to access arbitrary files
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 17.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
85%
Nuclei ×1 (last check)
critical → high
This vulnerability allows users of Gradio applications that have a public link (such as on Hugging Face Spaces) to access files on the machine hosting the Gradio application. This involves intercepting and modifying the network requests made by the Gradio app to the server.
Yes, the problem has been patched in Gradio version 4.19.2 or higher. We have no knowledge of this exploit being used against users of Gradio applications, but we encourage all users to upgrade to Gradio 4.19.2 or higher.
Fixed in: https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7 CVE: https://nvd.nist.gov/vuln/detail/CVE-2024-1728
gradio < 4.19.2Upgrade to a patched release:
gradio 4.19.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-49119High· 7.5Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticat…
CVE-2023-6572Critical· 9.6Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability
CVE-2023-51449High· 8.6Gradio makes the `/file` secure against file traversal and server-side request forgery attacks
CVE-2021-43831High· 8.3Files on the host computer can be accessed from the Gradio interface
CVE-2024-1183Medium· 6.5gradio Server-Side Request Forgery vulnerability
CVE-2024-1561High· 7.5gradio vulnerable to Path Traversal