---
id: CVE-2024-10648
aliases:
  - GHSA-pgfv-gvc5-prfg
  - PYSEC-2026-1417
title: Gradio Vulnerable to Arbitrary File Deletion
summary: Gradio Vulnerable to Arbitrary File Deletion
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'
vendor: gradio
product: gradio
ecosystem: pip
affected:
  - 'gradio >= 4.0.0, <= 5.0.0b2'
published: '2025-03-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-pgfv-gvc5-prfg'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-10648'
  - url: 'https://github.com/gradio-app/gradio'
  - url: >-
      https://github.com/gradio-app/gradio/blame/98cbcaef827de7267462ccba180c7b2ffb1e825d/gradio/processing_utils.py#L234
  - url: 'https://huntr.com/bounties/667d664d-8189-458c-8ed7-483fe8f33c76'
tags:
  - osv
  - pip
epss: 0.00717
epssPercentile: 0.51827
ingestedAt: '2026-07-08T18:25:51.764Z'
---

## Overview

A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset any file to an empty file, causing a denial of service (DOS) on the server.

## Affected packages

- `gradio >= 4.0.0, <= 5.0.0b2`

## Remediation

Refer to the advisory for the patched release.