Patchfirst
Patchfirst
CVE-2024-1728 Public exploit High · 7.5 EPSS 85.4%

Local File Inclusion in gradio-app/gradio

gradio-app · gradio-app/gradio

Summary

The local file inclusion flaw affects the gradio-app/gradio product, specifically the UploadButton component, where user-supplied input is not properly validated in the handling of file upload paths. An attacker with network access and no authentication or user interaction can manipulate the file path in requests to the /queue/join endpoint to read arbitrary files on the filesystem, such as private SSH keys, and redirect uploads to unintended server locations, which could potentially lead to remote code execution.

Official description · CVE.org

gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in the request to the `/queue/join` endpoint. This issue could potentially lead to remote code execution. The vulnerability is present in the handling of file upload paths, allowing attackers to redirect file uploads to unintended locations on the server.

Breakdown
30.2 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15

Disclosed on 10 Apr 2024. No public exploit code or confirmed exploitation is recorded.

See the family tree

8 related vulnerabilities in the same code over 12 months. The latest fix listed for gradio is 4.29.0.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. CVE-2023-34239Unfiltered paths in gradio7 Jun 2023
  2. relatedMedium

    Why these are linked:

    CVE-2023-51449Make the `/file` secure against file traversal attacks22 Dec 2023
  3. same family
    CVE-2024-0964LFI in Gradio5 Feb 2024
  4. same family
    CVE-2024-1727CSRF Vulnerability in gradio-app/gradio21 Mar 2024
  5. relatedHigh

    Why these are linked:

    CVE-2024-2206SSRF Vulnerability in gradio-app/gradio27 Mar 2024
  6. relatedHigh

    Why these are linked:

    • Fixed one release later4.18.0 → 4.19.2 (gradio)
    • Same code patched: route_utils.py (machine-matched)Functions: logincommit e329f1fcommit 49d9c48
    CVE-2024-1729Timing Attack Vulnerability in gradio-app/gradio29 Mar 2024
  7. same family
    This CVECVE-2024-1728Local File Inclusion in gradio-app/gradio10 Apr 2024
  8. relatedMedium

    Why these are linked:

    CVE-2024-4941Local File Inclusion in JSON component in gradio-app/gradio6 Jun 2024

Fixes in gradioPyPI package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 4.14.0CVE-2023-657214 Dec 2023
  2. 4.18.0CVE-2024-220627 Mar 2024
  3. 4.19.2CVE-2024-172721 Mar 2024
  4. 4.19.2CVE-2024-172929 Mar 2024
  5. 4.19.2CVE-2024-172810 Apr 2024
  6. 4.20.0CVE-2024-345105 May 2024
  7. 4.29.0CVE-2024-42534 Jun 2024Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: gradio.

PyPIgradioGHSA-m842-4qm8-7gpqPYSEC-2026-345

Upgrade to 4.19.2

Fixes this CVE and 1 other known vulnerability in this package (CVE-2024-1561).

Still affected on this line by CVE-2024-4325 (no fix published); CVE-2024-47167 (fixed in 5.0.0, a newer line); CVE-2026-28414 (fixed in 6.7.0, a newer line).

pippip install "gradio>=4.19.2"

The first fix for CVE-2024-1728.

Affected versions

If you runUpgrade to
All versions before 4.19.24.19.2

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

2 links, grouped by NVD tag

Other 2

huntr.com/bounties/9bb33b71-7995-425d-91cc-2c2a2f2a068agithub.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7
↑ ↓ chooseEnter openEsc close