Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-10648Path Traversal in gradio-app/gradio
High 8.2
In plain English
A high-severity security flaw in gradio-app/gradio from gradio-app. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.0)8.2High
Exploit odds (30 days)0.7%top 45.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset any file to an empty file, causing a denial of service (DOS) on the server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | gradio | no fix listed | GHSA-pgfv-gvc5-prfg |
| PyPI | gradio | no fix listed | PYSEC-2026-1417 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| gradio-app | gradio-app/gradio | unspecified – through latest |
Weakness: CWE-29 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H