Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai
CVE-2024-12217Path Traversal in gradio-app/gradio
Medium 5.3
In plain English
A medium-severity path traversal in gradio-app/gradio from gradio-app. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Official description
A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application correctly blocks access to paths like 'C:/tmp/secret.txt', it fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA'. This flaw can lead to unauthorized reading of blocked file paths.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | gradio | no fix listed | GHSA-prpg-p95c-32fv |
| PyPI | gradio | no fix listed | PYSEC-2026-1418 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| gradio-app | gradio-app/gradio | unspecified – through latest |
Weakness: CWE-22 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N