CVE-2024-51751: Arbitrary file read vulnerability in Gradio components

# CVE-2024-51751: Arbitrary file read vulnerability in Gradio components

https://gcdradar.vercel.app/incidents/cve-2024-51751-arbitrary-file-read-vulnerability-in-gradio-c · AIR-2024-0200 · closed 2024-11-06

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2024-11-06
- AI role: Attack on AI
- Products: Gradio
- CVE ids: CVE-2024-51751
- CVSS: 6.9

## Summary

Gradio contains an arbitrary file read vulnerability via its File and UploadButton components. Attackers with access to the application can abuse these components to access server files.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2024-11-06: CVE-2024-51751: Gradio is an open-source Python package designed to enable quick builds of a demo or web application. (https://nvd.nist.gov/vuln/detail/CVE-2024-51751)
- 2024-11-06: CVE-2024-51751: Gradio vulnerable to arbitrary file read with File and UploadButton components (https://github.com/advisories/GHSA-rhm9-gp5p-5248)

## Sources

- 2024-11-06 GitHub Advisory Database: CVE-2024-51751: Gradio vulnerable to arbitrary file read with File and UploadButton components https://github.com/advisories/GHSA-rhm9-gp5p-5248
- 2024-11-06 NVD: CVE-2024-51751: Gradio is an open-source Python package designed to enable quick builds of a demo or web application. https://nvd.nist.gov/vuln/detail/CVE-2024-51751

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.