PT-2025-4788 · Gradio · Gradio

Jackfromeast + 1 · Published 2025-01-14 · Updated 2025-08-26 · CVE-2025-23042

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 5.6.0

Description Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path due to the lack of case normalization in the file path validation logic. This issue can lead to unauthorized data access, exposing sensitive information and undermining the integrity of Gradio's security model. On case-insensitive file systems, such as those used by Windows and macOS, this flaw enables attackers to circumvent security restrictions and access sensitive files that should be protected.

Recommendations For Gradio versions prior to 5.6.0, upgrade to version 5.6.0 or later to address the vulnerability. As a temporary workaround, consider normalizing the case of both the requested path and the blocked paths (e.g., convert all paths to lowercase) before evaluating them against the ACL. Restrict access to sensitive files and directories until the issue is resolved.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

CWE-178

Related Identifiers

CVE-2025-23042

GHSA-J2JG-FQ62-7C3H

PYSEC-2025-118

Affected Products

Gradio

References · 16

• 🔥 https://github.com/gradio-app/gradio/security/advisories/GHSA-j2jg-fq62-7c3h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23042.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-23042 · Security Note
• https://osv.dev/vulnerability/CVE-2025-23042 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j2jg-fq62-7c3h · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-118 · Vendor Advisory
• https://github.com/gradio-app/gradio · Note
• https://github.com/gradio-app/gradio/releases/tag/gradio%405.11.0 · Note
• https://github.com/gradio-app/gradio/commit/6b63fdec441b5c9bf910f910a2505d8defbb6bf8 · Note
• https://twitter.com/CVEnew/status/1879290732114039239 · Twitter Post
• https://twitter.com/Dinosn/status/1879755928867946613 · Twitter Post
• https://t.me/cvedetector/15335 · Telegram Post
• https://t.me/pentestingnews/55319 · Telegram Post
• https://t.me/cveNotify/133509 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1879385092683968926 · Twitter Post