PT-2025-12050 · Gradio · Gradio

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-10648

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions gradio-app/gradio version git 98cbcae

Description A path traversal issue exists in the Gradio Audio component, allowing an attacker to control the format of the audio file. This can lead to arbitrary file content deletion by manipulating the output format, causing a denial of service (DOS) on the server.

Recommendations For version git 98cbcae, consider restricting access to the Gradio Audio component until a patch is available to prevent potential denial of service attacks. As a temporary workaround, avoid using the Gradio Audio component to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-29

Related Identifiers

CVE-2024-10648

GHSA-PGFV-GVC5-PRFG

Affected Products

Gradio

References · 7

• 🔥 https://huntr.com/bounties/667d664d-8189-458c-8ed7-483fe8f33c76 · Exploit
• https://osv.dev/vulnerability/CVE-2024-10648 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10648 · Security Note
• https://osv.dev/vulnerability/GHSA-pgfv-gvc5-prfg · Vendor Advisory
• https://github.com/gradio-app/gradio · Note
• https://github.com/gradio-app/gradio/blame/98cbcaef827de7267462ccba180c7b2ffb1e825d/gradio/processing_utils.py#L234 · Note
• https://twitter.com/CVEnew/status/1902671014070509735 · Twitter Post