Description
Gradio是一个开源 Python 库，是通过友好的 Web 界面演示机器学习模型的方法。 gradio存在路径遍历漏洞，该漏洞源于对用户提供的输入验证不正确。
gradio 路径遍历漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.sentinelone.com/vulnerability-database/cve-2024-0964/
https://nvd.nist.gov/vuln/detail/cve-2026-28414
https://horizon3.ai/attack-research/disclosures/exploiting-file-read-vulnerabilities-in-gradio-to-steal-secrets-from-hugging-face-spaces/
https://security.snyk.io/vuln/SNYK-PYTHON-GRADIO-8349640
https://github.com/gradio-app/gradio/security/advisories/GHSA-39mp-8hj3-5c49
https://cve.imfht.com/detail/CVE-2024-1728
https://www.nsfocus.net/vulndb/117419
https://www.oscs1024.com/hd/MPS-0ouj-c3fy
https://avd.aliyun.com/detail?id=AVD-2024-10707
https://www.anquanke.com/post/id/303570