CVE-2024-10648High· 8.2▾ TwilightGradio Vulnerable to Arbitrary File Deletion
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.7%
0.7% → 0.7%
A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset any file to an empty file, causing a denial of service (DOS) on the server.
gradio >= 4.0.0, <= 5.0.0b2Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-6572Critical· 9.6Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability
CVE-2023-51449High· 8.6Gradio makes the `/file` secure against file traversal and server-side request forgery attacks
CVE-2023-25823Medium· 5.4Update share links to use FRP instead of SSH tunneling
CVE-2023-34239High· 7.3Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs
GHSA-26jh-r8g2-6fprMedium· 5.3Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list
CVE-2026-10783Low· 2.5Gradio: Audio cache key ignores metadata when saving numpy audio outputs