CVE-2024-51751

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary files from the application server. This issue has been addressed in release version 5.5.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Nov 6, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-517525.5The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. I CVE-2024-517532.1The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In af CVE-2024-517542.2Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not CVE-2024-517552.2Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the s CVE-2024-517562.3The cap-std project is organized around the eponymous `cap-std` crate, and develops libraries to make it easy to write capability-based code CVE-2024-517579.3happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may e CVE-2024-517582.3Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use CVE-2024-517597.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Detlef Beyer SVT Simple svt-simple all CVE-2024-51769.4Insufficiently Protected Credentials vulnerability in Baxter Welch Allyn Configuration Tool may allow Remote Services with Stolen Credential CVE-2024-517607.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ristretto Apps Dashing Memberships das CVE-2024-517617.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zackgilbert WPHelpful wphelpful allows CVE-2024-517627.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Gipple PropertyShift propertyshi