{"data":{"id":"7676008c-dd75-4bdd-8740-370631503850","title":"CVE-2024-12217: A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The…","summary":"CVE-2024-12217 affects the gradio-app/gradio repository at version git 67e4044 on Windows. The blocked_path check, meant to stop users from reading certain files, fails when a path uses NTFS Alternate Data Streams syntax, such as 'C:/tmp/secret.txt::$DATA', even though the plain path is blocked. This flaw allows unauthorized reading of blocked file paths.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-12217","publishedAt":"2025-03-20T14:15:27.560Z","cveId":"CVE-2024-12217","cweIds":["CWE-22"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@<= 5.0.1"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"gradio-app/gradio path traversal on Windows via NTFS alternate data streams","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00698,"epssCheckedAt":"2026-11-04T12:08:33.171Z","kevDateAdded":null,"advisoryAliases":["GHSA-prpg-p95c-32fv"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:54:18.105Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[]}}