gcdRadar
archive/Patch now/AIR-2025-0405
closedclosed 20 Mar 2025Patch now2 Disclosed vulnerabilityAI

CVE-2024-10707: Local file inclusion vulnerability in ChuanhuChatGPT

ChuanhuChatGPT, Gradio

ChuanhuChatGPT contains a local file inclusion vulnerability via improper input validation in its Gradio component usage. Unauthenticated attackers can access arbitrary files on the affected server.

disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why

CVSS
6.5
EPSS
0.01 · top 45% · 2026-11-13
EPSS scores by FIRST
fix status
Fix status unknown
first report
20 Mar 2025
last update
20 Mar 2025
CVE ids
CVE-2024-10707other records

Timeline · 1

  1. 20 Mar 2025CVE-2024-10707: gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio…

Sources · 1

Advisories and databases

  1. 2025-03-20
    CVE-2024-10707: gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio…
    NVD · nvd.nist.gov/vuln/detail/CVE-2024-10707

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

lane
Patch now
AI role
Attack on AI
categories
Infrastructure vulnerability
severity
2 · Disclosed vulnerability
fix status
Fix status unknown
targets
Framework / tooling
owasp llm top 10
LLM03:2025 Supply Chain
mitre atlas
no technique for these categories
tags
lfi
dates
happened 20 Mar 2025 · first reported 20 Mar 2025
origin
NVD
Vulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
record
confidence 0.95 · created 2026-10-18 10:04Z · updated 2026-10-18 10:04Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# CVE-2024-10707: Local file inclusion vulnerability in ChuanhuChatGPT

https://gcdradar.vercel.app/incidents/cve-2024-10707-local-file-inclusion-vulnerability-in-chuanhu · AIR-2025-0405 · closed 2025-03-20

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-03-20
- AI role: Attack on AI
- Products: ChuanhuChatGPT, Gradio
- CVE ids: CVE-2024-10707
- CVSS: 6.5

## Summary

ChuanhuChatGPT contains a local file inclusion vulnerability via improper input validation in its Gradio component usage. Unauthenticated attackers can access arbitrary files on the affected server.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-03-20: CVE-2024-10707: gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio… (https://nvd.nist.gov/vuln/detail/CVE-2024-10707)

## Sources

- 2025-03-20 NVD: CVE-2024-10707: gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio… https://nvd.nist.gov/vuln/detail/CVE-2024-10707

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. closed7.5
    Gradio CVE-2025-0187: Denial of service vulnerability in Gradio file upload feature

    Patch now · Disclosed · since 20 Mar 2025 · CVE-2025-0187

    AI
  2. closed7.5
    ChuanhuChatGPT CVE-2024-10650: ChuanhuChatGPT denial of service vulnerability

    Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-10650

    AI
  3. closed5.4
    Gradio CVE-2024-8021: Gradio Open Redirect Vulnerability Disclosed

    Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-8021

    AI
  4. closed7.5
    Gradio CVE-2024-10569: Gradio vulnerable to denial of service via zip bomb

    Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-10569

    AI
  5. closed8.2
    Gradio CVE-2024-10648: Gradio Vulnerable to Arbitrary File Deletion

    Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-10648

    AI
  6. closed7.5
    Gradio CVE-2024-8966: Gradio denial of service via multipart boundary file upload

    Patch now · Disclosed · since 20 Mar 2025 · CVE-2024-8966

    AI