{"data":{"id":"1a6fa642-16a0-4eac-976d-ccd02071c217","title":"CVE-2024-48052: In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The…","summary":"CVE-2024-48052 affects gradio versions up to and including 4.42.0. In these versions, the gr.DownloadButton function contains a server-side request forgery (SSRF) flaw in its save_url_to_cache function, which places no restrictions on the URL. According to the source, this allows access to local target resources, which can lead to the download of local resources and sensitive information.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-48052","publishedAt":"2024-11-05T04:15:04.337Z","cveId":"CVE-2024-48052","cweIds":["CWE-918"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@<= 4.42.0"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"gradio gr.DownloadButton server-side request forgery in save_url_to_cache","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0047,"epssCheckedAt":"2026-11-04T18:09:14.608Z","kevDateAdded":null,"advisoryAliases":["GHSA-3gf9-wv65-gwh9"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:51.685Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-664"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}