CVE-2024-1561: gradio vulnerable to Path Traversal

# CVE-2024-1561: gradio vulnerable to Path Traversal

https://gcdradar.vercel.app/incidents/cve-2024-1561-gradio-vulnerable-to-path-traversal · AIR-2024-0087 · closed 2024-04-16

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-04-16
- AI role: Attack on AI
- Products: gradio
- CVE ids: CVE-2024-1561
- CVSS: 7.5

## Summary

An issue in Gradio allows remote attackers to read arbitrary files via the component server endpoint. The vulnerability is addressed in patched versions.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-04-16: CVE-2024-1561: An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any… (https://nvd.nist.gov/vuln/detail/CVE-2024-1561)
- 2024-04-16: CVE-2024-1561: gradio vulnerable to Path Traversal (https://github.com/advisories/GHSA-g9cj-cfpp-4g2x)

## Sources

- 2024-04-16 GitHub Advisory Database: CVE-2024-1561: gradio vulnerable to Path Traversal https://github.com/advisories/GHSA-g9cj-cfpp-4g2x
- 2024-04-16 NVD: CVE-2024-1561: An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any… https://nvd.nist.gov/vuln/detail/CVE-2024-1561

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.