~ / search / GHSA-pgfv-gvc5-prfg

GHSA-pgfv-gvc5-prfg

Gradio Vulnerable to Arbitrary File Deletion

Source: GitHub Advisory Database (reviewed) High CVE-2024-10648

Packages

EcosystemPackageAffectedFixed in
PyPI gradio >= 4.0.0, <= 5.0.0b2 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset any file to an empty file, causing a denial of service (DOS) on the server.

References

External links from the advisory. They lead to third-party sites.