PT-2025-12126 · Gradio · Gradio

Published 2024-11-10 · Updated 2025-03-20 · CVE-2024-12217

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions gradio-app/gradio version git 67e4044

Description A flaw in the implementation of the blocked path functionality allows for path traversal on Windows OS. The application fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA', which can lead to unauthorized reading of blocked file paths.

Recommendations For version git 67e4044, consider disabling the blocked path functionality until a patch is available to prevent path traversal attacks. Restrict access to sensitive files and directories to minimize the risk of exploitation. Avoid using NTFS Alternate Data Streams (ADS) syntax in file paths to prevent bypassing the blocked path functionality.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-41

Related Identifiers

BDU:2026-01839

CVE-2024-12217

GHSA-PRPG-P95C-32FV

Affected Products

Gradio

References · 8

• 🔥 https://huntr.com/bounties/0439bf3d-cb38-43a5-8314-0fadf85cc5a0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12217 · Security Note
• https://bdu.fstec.ru/vul/2026-01839 · Security Note
• https://osv.dev/vulnerability/GHSA-prpg-p95c-32fv · Vendor Advisory
• https://github.com/gradio-app/gradio · Note
• https://github.com/gradio-app/gradio/pull/9635 · Note
• https://github.com/gradio-app/gradio/blob/67e4044c9ca8358eceeb1fa72fa415df03397d20/gradio/utils.py#L1061-L1074 · Note
• https://twitter.com/CVEnew/status/1902671018549989794 · Twitter Post