Gradio
CVE-2023-41626
MEDIUM
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
1Blast Radius
ecosystem impact- 1 pypi packages depend on gradio (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.27.0.
DescriptionNVD
Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface.
AnalysisAI
Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface. Affected products include: Gradio Project Gradio.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.
Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py. Rat
A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API reques
A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.y
A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within t
A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. Rat
A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due
Command Injection in GitHub repository gradio-app/gradio prior to main. Rated high severity (CVSS 8.1), this vulnerabili
Gradio is an open source framework for building interactive machine learning models and demos. Rated high severity (CVSS
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the g
A Denial of Service (DoS) vulnerability was discovered in the file upload feature of gradio-app/gradio version 0.39.1. R
A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. Rate
Gradio versions up to 6.7 contains a vulnerability that allows attackers to read arbitrary files from the file system (C
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today