CVE-2023-51449
Description
Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.
How to fix
- gradio_project gradio4.11.0 or later
- gradio4.11.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gradio_project gradio | v < 4.11.0 | 4.11.0 |
| gradioPyPI | v < 4.11.0 | 4.11.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.