Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0zZjk1LW14cTItMmY2M84AA64H
Gradio Local File Inclusion vulnerability
gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in the request to the /queue/join
endpoint. This issue could potentially lead to remote code execution. The vulnerability is present in the handling of file upload paths, allowing attackers to redirect file uploads to unintended locations on the server.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zZjk1LW14cTItMmY2M84AA64H
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 22 days ago
Updated: 22 days ago
CVSS Score: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Identifiers: GHSA-3f95-mxq2-2f63, CVE-2024-1728
References:
- https://nvd.nist.gov/vuln/detail/CVE-2024-1728
- https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7
- https://huntr.com/bounties/9bb33b71-7995-425d-91cc-2c2a2f2a068a
- https://github.com/advisories/GHSA-3f95-mxq2-2f63
Blast Radius: 30.5
Affected Packages
pypi:gradio
Dependent packages: 213Dependent repositories: 11,837
Downloads: 6,147,076 last month
Affected Version Ranges: < 4.19.2
Fixed in: 4.19.2
All affected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.0, 0.2.1, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.4.0, 0.4.1, 0.4.2, 0.4.4, 0.5.0, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7, 0.7.8, 0.8.0, 0.8.1, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5, 0.9.6, 0.9.7, 0.9.8, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.8, 1.1.9, 1.2.2, 1.2.3, 1.3.0, 1.3.1, 1.3.2, 1.4.0, 1.4.2, 1.4.3, 1.4.4, 1.5.0, 1.5.1, 1.5.3, 1.5.4, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.4, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.7.7, 2.0.0, 2.0.1, 2.0.2, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.1.0, 2.1.1, 2.1.2, 2.1.4, 2.1.6, 2.1.7, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.10, 2.2.11, 2.2.12, 2.2.13, 2.2.14, 2.2.15, 2.3.0, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.9, 2.4.0, 2.4.1, 2.4.2, 2.4.4, 2.4.5, 2.4.6, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.7.0, 2.7.5, 2.8.0, 2.8.1, 2.8.2, 2.8.3, 2.8.4, 2.8.5, 2.8.6, 2.8.7, 2.8.8, 2.8.9, 2.8.10, 2.8.11, 2.8.12, 2.8.13, 2.8.14, 2.9.0, 2.9.1, 2.9.2, 2.9.3, 2.9.4, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.15, 3.0.16, 3.0.17, 3.0.18, 3.0.19, 3.0.20, 3.0.21, 3.0.22, 3.0.23, 3.0.24, 3.0.25, 3.0.26, 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.3.1, 3.4.1, 3.8.1, 3.8.2, 3.9.1, 3.10.0, 3.10.1, 3.11.0, 3.12.0, 3.13.0, 3.13.1, 3.13.2, 3.14.0, 3.15.0, 3.16.0, 3.16.1, 3.16.2, 3.17.0, 3.17.1, 3.18.0, 3.19.0, 3.19.1, 3.20.0, 3.20.1, 3.21.0, 3.22.0, 3.22.1, 3.23.0, 3.24.0, 3.24.1, 3.25.0, 3.26.0, 3.27.0, 3.28.0, 3.28.1, 3.28.2, 3.28.3, 3.29.0, 3.30.0, 3.31.0, 3.32.0, 3.33.0, 3.33.1, 3.34.0, 3.35.0, 3.35.1, 3.35.2, 3.36.0, 3.36.1, 3.37.0, 3.38.0, 3.39.0, 3.40.0, 3.40.1, 3.41.0, 3.41.1, 3.41.2, 3.42.0, 3.43.0, 3.43.1, 3.43.2, 3.44.0, 3.44.1, 3.44.2, 3.44.3, 3.44.4, 3.45.0, 3.45.1, 3.45.2, 3.46.0, 3.46.1, 3.47.0, 3.47.1, 3.48.0, 3.49.0, 3.50.0, 3.50.1, 3.50.2, 4.0.0, 4.0.1, 4.0.2, 4.1.0, 4.1.1, 4.1.2, 4.2.0, 4.3.0, 4.4.0, 4.4.1, 4.5.0, 4.7.0, 4.7.1, 4.8.0, 4.9.0, 4.9.1, 4.10.0, 4.11.0, 4.12.0, 4.13.0, 4.14.0, 4.15.0, 4.16.0, 4.17.0, 4.18.0, 4.19.0, 4.19.1
All unaffected versions: 4.19.2, 4.20.0, 4.20.1, 4.21.0, 4.22.0, 4.23.0, 4.24.0, 4.25.0, 4.26.0, 4.27.0, 4.28.0, 4.28.1, 4.28.2, 4.28.3