Improper access control in Gradio - CVE-2024-1728
Published: September 25, 2024 / Updated: April 28, 2026
Vulnerability identifier: #VU128279
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-1728
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose arbitrary files from the machine hosting the Gradio application.
The vulnerability exists due to improper access control in the Gradio file access handling when processing modified network requests to the server. A remote user can intercept and modify network requests made by the Gradio app to disclose arbitrary files from the machine hosting the Gradio application.
Only applications exposed through a publicly accessible Gradio link are vulnerable.
Affected software
Gradio
How to mitigate CVE-2024-1728
Install security update from vendor's website.
Gradio - update to 4.19.2