CVE-2025-48889

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Prior to version 5.31.0, an arbitrary file copy vulnerability in Gradio's flagging feature allows unauthenticated attackers to copy any readable file from the server's filesystem. While attackers can't read these copied files, they can cause DoS by copying large files (like /dev/urandom) to fill disk space. This issue has been patched in version 5.31.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
May 30, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-48897.8A vulnerability has been found in code-projects Tourism Management System 1.0 and classified as critical. This vulnerability affects the funCVE-2025-488909.3WRH-733GBK and WRH-733GWH contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilitCVE-2025-488917.6A vulnerability exists in Advantech iView that could allow for SQL injection through the CUtils.checkSQLInjection() function. This vulneraCVE-2025-48907.8A vulnerability was found in code-projects Tourism Management System 1.0 and classified as critical. This issue affects the function LoginUsCVE-2025-489026.6Vulnerability of uncontrolled system resource applications in the setting module Impact: Successful exploitation of this vulnerability may aCVE-2025-489037.8Permission bypass vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-489046.2Vulnerability that cards can call unauthorized APIs in the FRS process Impact: Successful exploitation of this vulnerability may affect avaiCVE-2025-489058.1Wasm exception capture vulnerability in the arkweb v8 module Impact: Successful exploitation of this vulnerability may cause the failure to CVE-2025-489068.8Authentication bypass vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-489076.2Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-489086.7Ability Auto Startup service vulnerability in the foundation process Impact: Successful exploitation of this vulnerability may affect availaCVE-2025-489097.1Bypass vulnerability in the device management channel Impact: Successful exploitation of this vulnerability may affect service confidentiali
CVE-2025-48889: High severity, CVSS 7.5 | Vulnix