p PatchFirst

CVE-2024-10648

CVE-2024-10648 · Path Traversal in gradio-app/gradio

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset any file to an empty file, causing a denial of service (DOS) on the server.

CVSS 8.2 · High · EPSS 0.7%

Published
Updated

Stack: python

Affected products and versions

  • gradio-app/gradio

    Versions
    • ≥ unspecified, ≤ latest: Affected (custom)

    No fix published

  • gradio PyPI

    Versions
    • 4.0.0
    • 4.0.1
    • 4.0.2
    • 4.1.0
    • 4.1.1
    • 4.1.2
    • 4.10.0
    • 4.11.0
    • 4.12.0
    • 4.13.0
    • 4.14.0
    • 4.15.0
    • 4.16.0
    • 4.17.0
    • 4.18.0
    • 4.19.0
    • 4.19.1
    • 4.19.2
    • 4.2.0
    • 4.20.0
    • 4.20.1
    • 4.21.0
    • 4.22.0
    • 4.23.0
    • 4.24.0
    • 4.25.0
    • 4.26.0
    • 4.27.0
    • 4.28.0
    • 4.28.1
    • 4.28.2
    • 4.28.3
    • 4.29.0
    • 4.3.0
    • 4.31.0
    • 4.31.1
    • 4.31.2
    • 4.31.3
    • 4.31.4
    • 4.31.5
    • 4.32.0
    • 4.32.1
    • 4.32.2
    • 4.33.0
    • 4.35.0
    • 4.36.0
    • 4.36.1
    • 4.37.1
    • 4.37.2
    • 4.38.0
    • 4.38.1
    • 4.39.0
    • 4.4.0
    • 4.4.1
    • 4.40.0
    • 4.41.0
    • 4.42.0
    • 4.43.0
    • 4.44.0
    • 4.44.1
    • 4.5.0
    • 4.7.0
    • 4.7.1
    • 4.8.0
    • 4.9.0
    • 4.9.1
    • 5.0.0b1
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0, ≤ 5.0.0b2

    No fix published

Original sources

Check your server →