{"data":{"id":"3fe71e63-cad3-4bfa-99e8-2cfd1297121a","title":"CVE-2024-47166: Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **one-level read…","summary":"Gradio, an open-source Python package for quick prototyping, contains a one-level read path traversal in its `/custom_component` endpoint. An attacker who manipulates the file path in a request can read and leak source code from custom Gradio components hosted on publicly accessible servers, which may include proprietary or sensitive code.","solution":"Upgrade to `gradio>=4.44`. As a workaround, sanitize file paths and ensure components are not stored in publicly accessible directories.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-47166","publishedAt":"2024-10-11T02:15:10.833Z","cveId":"CVE-2024-47166","cweIds":["CWE-22"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@< 4.44.0 (fixed: 4.44.0)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio one-level read path traversal in /custom_component endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00436,"epssCheckedAt":"2026-11-04T06:10:14.105Z","kevDateAdded":null,"advisoryAliases":["GHSA-37qc-qgx6-9xjv"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:05.687Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-09-10T21:46:23.568Z","daysToFix":-31,"fixCheckedAt":"2026-10-29T21:45:25.747Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"4.44.0","matchedVersion":"4.44.0","fixReleasedAt":"2024-09-10T21:46:23.568Z","daysToFix":-31,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:25.596Z"}]}}