CVE-2023-51449

    Dashboard / Vulnerabilities / CVE-2023-51449

    CVE-2023-51449

    Published: 22 Dec 2023Last Modified: 12 Aug 2026

    Summary: Make the `/file` secure against file traversal attacks

    Details: Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51449.json, https://github.com/gradio-app/gradio/security/advisories/GHSA-6qm2-wpxq-7qh2, https://nvd.nist.gov/vuln/detail/CVE-2023-51449, https://github.com/gradio-app/gradio/commit/1b9d4234d6c25ef250d882c7b90e1f4039ed2d76, https://github.com/gradio-app/gradio/commit/7ba8c5da45b004edd12c0460be9222f5b5f5f055

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -160e3895805a45030a5e051f6bec2d399e354ad1

    Affected versions

    [email protected]

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-51449 | CVE-DB