CVE-2024-12217: Gradio Path Traversal via NTFS Alternate Data Streams

# CVE-2024-12217: Gradio Path Traversal via NTFS Alternate Data Streams

https://gcdradar.vercel.app/incidents/cve-2024-12217-gradio-path-traversal-via-ntfs-alternate-data · AIR-2025-0222 · closed 2025-03-20

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2025-03-20
- AI role: Attack on AI
- Products: gradio
- CVE ids: CVE-2024-12217
- CVSS: 5.3

## Summary

A path traversal vulnerability in Gradio on Windows OS allows bypassing file access restrictions. Attackers can read blocked files using NTFS Alternate Data Streams syntax.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2025-03-20: CVE-2024-12217: A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. (https://nvd.nist.gov/vuln/detail/CVE-2024-12217)
- 2025-03-20: CVE-2024-12217: Gradio Path Traversal vulnerability (https://github.com/advisories/GHSA-prpg-p95c-32fv)

## Sources

- 2025-03-20 GitHub Advisory Database: CVE-2024-12217: Gradio Path Traversal vulnerability https://github.com/advisories/GHSA-prpg-p95c-32fv
- 2025-03-20 NVD: CVE-2024-12217: A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. https://nvd.nist.gov/vuln/detail/CVE-2024-12217

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.