{"data":{"id":"439c9471-70ff-495b-8b42-0d9ce4727023","title":"CVE-2024-51751: Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or…","summary":"CVE-2024-51751 affects Gradio, an open-source Python package for building demo and web applications. When the File or UploadButton components are used to preview file content, an attacker with access to the application can abuse them to read arbitrary files from the application server, which is a path traversal flaw (CWE-22).","solution":"This issue has been addressed in release version 5.5.0, and users are advised to upgrade. There are no known workarounds for this vulnerability.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-51751","publishedAt":"2024-11-07T01:15:05.557Z","cveId":"CVE-2024-51751","cweIds":["CWE-22"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@>= 5.0.0, < 5.5.0 (fixed: 5.5.0)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio file preview components allow reading arbitrary files on the server","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00681,"epssCheckedAt":"2026-11-04T06:10:14.410Z","kevDateAdded":null,"advisoryAliases":["GHSA-rhm9-gp5p-5248"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:50.708Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-11-04T23:15:16.011Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:45:15.202Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"5.5.0","matchedVersion":"5.5.0","fixReleasedAt":"2024-11-04T23:15:16.011Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:45:14.952Z"}]}}