PT-2025-12126 · Gradio · Gradio

Publicado 2024-11-10 · Atualizado 2025-03-20 · CVE-2024-12217

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions gradio-app/gradio version git 67e4044

Description A flaw in the implementation of the blocked path functionality allows for path traversal on Windows OS. The application fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA', which can lead to unauthorized reading of blocked file paths.

Recommendations For version git 67e4044, consider disabling the blocked path functionality until a patch is available to prevent path traversal attacks. Restrict access to sensitive files and directories to minimize the risk of exploitation. Avoid using NTFS Alternate Data Streams (ADS) syntax in file paths to prevent bypassing the blocked path functionality.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

CWE-41

Identificadores relacionados

BDU:2026-01839

CVE-2024-12217

GHSA-PRPG-P95C-32FV

Produtos afetados

Gradio

Referências · 8

• 🔥 https://huntr.com/bounties/0439bf3d-cb38-43a5-8314-0fadf85cc5a0 · Exploit
• https://github.com/gradio-app/gradio · Nota
• https://github.com/gradio-app/gradio/pull/9635 · Nota
• https://github.com/gradio-app/gradio/blob/67e4044c9ca8358eceeb1fa72fa415df03397d20/gradio/utils.py#L1061-L1074 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-12217 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-01839 · Nota de Segurança
• https://twitter.com/CVEnew/status/1902671018549989794 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-prpg-p95c-32fv · Aviso do Fabricante