Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2023-51449 Details

Description

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CNA: [email protected]CVSS-B:5.6 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/gradio-app/gradio/commit/1b9d4234d6c25ef250d882c7b90e1f4039ed2d76	CVE	Patch
https://github.com/gradio-app/gradio/commit/7ba8c5da45b004edd12c0460be9222f5b5f5f055	CVE	Patch
https://github.com/gradio-app/gradio/security/advisories/GHSA-6qm2-wpxq-7qh2	CVE	Third Party Advisory
https://github.com/gradio-app/gradio/commit/1b9d4234d6c25ef250d882c7b90e1f4039ed2d76	[email protected]	Patch
https://github.com/gradio-app/gradio/commit/7ba8c5da45b004edd12c0460be9222f5b5f5f055	[email protected]	Patch
https://github.com/gradio-app/gradio/security/advisories/GHSA-6qm2-wpxq-7qh2	[email protected]	Third Party Advisory

see all 6 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	[email protected]

Affected Products

Product	Versions
gradio project gradio	< 4.11.0
CPE cpe:2.3:a:gradio_project:gradio::::::python::* Remediation No remediation found in references.

Change History

7 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	CISA-ADP
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Jan 9, 2024	Reanalysis	[email protected]
Jan 3, 2024	Initial Analysis	[email protected]
Dec 22, 2023	New CVE Received	[email protected]