CVE-2023-51449: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
(updated )
Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of gradio prior to 4.11.0 contained a vulnerability in the /file route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with share=True, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.
References
- github.com/advisories/GHSA-6qm2-wpxq-7qh2
- github.com/gradio-app/gradio/commit/1b9d4234d6c25ef250d882c7b90e1f4039ed2d76
- github.com/gradio-app/gradio/commit/7ba8c5da45b004edd12c0460be9222f5b5f5f055
- github.com/gradio-app/gradio/security/advisories/GHSA-6qm2-wpxq-7qh2
- nvd.nist.gov/vuln/detail/CVE-2023-51449
Code Behaviors & Features
Detect and mitigate CVE-2023-51449 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →