VulnerabilityAnalyzed

CVE-2024-10648

A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae.

HIGH 8.2EPSS 0.70%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.70%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset any file to an empty file, causing a denial of service (DOS) on the server.

CVSS 3.0: 8.2 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS: 0.70% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-29
Affected: gradio project/gradio
Source: security@huntr.dev

References

https://huntr.com/bounties/667d664d-8189-458c-8ed7-483fe8f33c76Exploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.