CVE-2024-48052

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Nov 4, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-480576.1localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can CVE-2024-480596.1gaizhenbiao/chuanhuchatgpt project, version <=20240802 is vulnerable to stored Cross-Site Scripting (XSS) in WebSocket session transmission.CVE-2024-48068.8A vulnerability classified as critical was found in Kashipara College Management System 1.0. This vulnerability affects unknown code of the CVE-2024-480619.8langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on th CVE-2024-480639.8In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior i CVE-2024-480686.1A cross-site scripting (XSS) vulnerability in Shenzhen Landray Software Co.,LTD Landray EKP v16 and earlier allows attackers to execute arbi CVE-2024-480699.8A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files an CVE-2024-48078.8A vulnerability, which was classified as critical, has been found in Kashipara College Management System 1.0. This issue affects some unknow CVE-2024-480709.8An issue in Weaver E-cology v. attackers construct special requests to insert remote malicious code and to trigger malicious code execution,CVE-2024-480716.5E-cology has a directory traversal vulnerability. An attacker can exploit this vulnerability to delete the server directory, causing the ser CVE-2024-480729.8Weaver Ecology v9.* was discovered to contain a SQL injection vulnerability via the component /mobilemode/Action.jsp?invoker=com.weaver.form CVE-2024-480739.8sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is responsible for upda