{"data":{"id":"644abab2-d6f7-49a4-9d7d-169eac06a049","title":"CVE-2025-48889: Gradio is an open-source Python package that allows quick building of demos and web application for machine learning…","summary":"Gradio, an open-source Python package for building demos and web applications for machine learning models, has an arbitrary file copy vulnerability in its flagging feature in versions prior to 5.31.0. Unauthenticated attackers can copy any readable file from the server's filesystem, though they cannot read the copies, and can cause denial of service by copying large files such as /dev/urandom to fill disk space.","solution":"Fixed in version 5.31.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-48889","publishedAt":"2025-05-30T10:15:28.500Z","cveId":"CVE-2025-48889","cweIds":["CWE-434"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["gradio@< 5.31.0 (fixed: 5.31.0)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Gradio arbitrary file copy in flagging feature allows unauthenticated attackers","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00688,"epssCheckedAt":"2026-11-04T06:10:15.563Z","kevDateAdded":null,"advisoryAliases":["GHSA-8jw3-6x8j-v96g"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:53:41.907Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-05-22T19:44:47.607Z","daysToFix":-8,"fixCheckedAt":"2026-10-29T21:44:26.676Z","capecIds":["CAPEC-1"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"5.31.0","matchedVersion":"5.31.0","fixReleasedAt":"2025-05-22T19:44:47.607Z","daysToFix":-8,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:44:26.526Z"}]}}