← Back

CVE-2024-10648

nvd nist
Published: Mar 20, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.2
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Exploitability: 3.9 / Impact: 4.2
Source: security@huntr.dev (Secondary)

Description

A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset any file to an empty file, causing a denial of service (DOS) on the server.

Affected (1)

Gradio Project
1 product
Gradio
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Gradio
Version 2024-09-18

Related CWEs

CWE-29
Path Traversal: '\..\filename'
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\..\filename' (leading backslash dot dot) sequences that can resolve to a location that is outside of that directory.

References (1)

Source: security@huntr.dev
ExploitThird Party Advisory

Timeline

No history available yet.