{"data":{"id":"fc97834e-3537-4fc6-9ac7-61afed745449","title":"CVE-2024-1728: gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied…","summary":"CVE-2024-1728 affects gradio-app/gradio because the UploadButton component does not properly validate user-supplied input. An attacker can manipulate the file path in a request to the /queue/join endpoint to read arbitrary files on the filesystem, such as private SSH keys. The flaw can also redirect file uploads to unintended server locations and could potentially lead to remote code execution.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-1728","publishedAt":"2024-04-10T21:15:53.097Z","cveId":"CVE-2024-1728","cweIds":["CWE-22"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["gradio@< 4.19.2 (fixed: 4.19.2)"],"affectedPackageNames":["gradio"],"affectedPackageRefs":["pypi:gradio"],"affectedVendors":[],"affectedVendorsRaw":["Gradio"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"gradio-app/gradio local file inclusion in UploadButton via /queue/join","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.85393,"epssCheckedAt":"2026-11-04T06:10:14.546Z","kevDateAdded":null,"advisoryAliases":["GHSA-m842-4qm8-7gpq"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:18.606Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-02-22T21:38:07.030Z","daysToFix":-48,"fixCheckedAt":"2026-10-29T21:46:13.959Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"gradio","fixedVersion":"4.19.2","matchedVersion":"4.19.2","fixReleasedAt":"2024-02-22T21:38:07.030Z","daysToFix":-48,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:13.797Z"}]}}