CVE-2023-51449

MEDIUM NUCLEI

gradio < 4.11.0 - Path Traversal via /file Route

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-51449 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.

Nuclei Templates (1)

Gradio Hugging Face - Local File Inclusion
HIGHVERIFIEDby nvn1729
Shodan: html:"__gradio_mode__"
FOFA: body="__gradio_mode__"

References (3)

Core 3

Scores

CVSS v3 5.6
EPSS 0.0228
EPSS Percentile 80.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (2)
gradio_project/gradio < 4.11.0
pypi/gradio 0 - 4.11.0PyPI
Published Dec 22, 2023
Tracked Since Feb 18, 2026