PT-2025-12120 · Gradio+1 · Gradio+1

Published 2025-03-20 · Updated 2025-10-21 · CVE-2024-12065

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions haotian-liu/llava at commit c121f04

Description A local file inclusion issue exists, allowing an attacker to access any file on the system by sending multiple crafted requests to the server. This is due to improper input validation in the gradio web UI component.

Recommendations For haotian-liu/llava at commit c121f04, consider disabling the gradio web UI component until a patch is available to prevent exploitation. Restrict access to sensitive files and directories to minimize the risk of unauthorized access. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Path traversal

RCE

Weakness Enumeration

CWE-22

CWE-20

Related Identifiers

CVE-2024-12065

Affected Products

Gradio

Llava

References · 5

• 🔥 https://huntr.com/bounties/0594503c-038f-401c-9127-08be32bfd682 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12065 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12065 · Vendor Advisory
• https://twitter.com/CVEnew/status/1902968867305230475 · Twitter Post
• https://t.me/cveNotify/139611 · Telegram Post