H3-2024-0031¶
Gradio Arbitrary File Read Vulnerability
| Category | VULNERABILITY |
| Base Score | 7.5 |
Description¶
The Gradio server is vulnerable to a path traversal and/or a local file inclusion vulnerability. Note: This weakness tracks multiple Gradio CVEs that result in arbitrary file read.
Impact¶
Remote unauthenticated attackers can read arbitrary files from the Gradio target host, leading to potential disclosure of sensitive information such as HuggingFace tokens, or environment variables containing secrets such as API keys.