CVE-2025-48889: Gradio arbitrary file copy in flagging feature allows unauthenticated attackers

Summary

Gradio, an open-source Python package for building demos and web applications for machine learning models, has an arbitrary file copy vulnerability in its flagging feature in versions prior to 5.31.0. Unauthenticated attackers can copy any readable file from the server's filesystem, though they cannot read the copies, and can cause denial of service by copying large files such as /dev/urandom to fill disk space.

Mitigation

Fixed in version 5.31.0.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• gradioPyPILLM dependency since 2023-03-14 · 11 tracked dependents

Related items

• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
• InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-118761: Kubeflow Pipelines decompression bomb in pipeline archive uploadSimilar attack · NVD/CVE Database
• LowOpenCode User Hit with Hostile Backlash After Reporting Free AI LoopholeSimilar attack · Socket Blog