Improper access control in Gradio - CVE-2024-1728
Published: September 25, 2024 / Updated: April 28, 2026
Vulnerability identifier: #VU128279
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-1728
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Gradio
Affected software:
Gradio
Gradio
Detailed vulnerability description
The vulnerability allows a remote user to disclose arbitrary files from the machine hosting the Gradio application.
The vulnerability exists due to improper access control in the Gradio file access handling when processing modified network requests to the server. A remote user can intercept and modify network requests made by the Gradio app to disclose arbitrary files from the machine hosting the Gradio application.
Only applications exposed through a publicly accessible Gradio link are vulnerable.
How to mitigate CVE-2024-1728
Install security update from vendor's website.