Directory traversal bypass in Gradio is_in_or_equal function (CVE-2024-47164)
Gradio versions prior to 5.0 contain a directory traversal vulnerability in the is_in_or_equal function that can be bypassed using parent directory sequences to potentially access restricted files. The vulnerability was disclosed and patched in version 5.0.
What happened
The is_in_or_equal function in Gradio versions prior to 5.0 contains a directory traversal vulnerability that can be bypassed with payloads using .. (parent directory) sequences to manipulate file paths.
Attackers could potentially exploit this flaw to access restricted files, although the difficulty is noted as high.
Reported impact
The vulnerability primarily impacts users relying on Gradio's blocklist or directory access validation, particularly when handling file uploads.
Index analysis
The vulnerability relates to the bypass of directory traversal checks within the is_in_or_equal function, which is intended to check if a file resides within a given directory.
Governance controls
Gradio released version 5.0 with patches addressing the issue. As a workaround, users can manually sanitize and normalize file paths before passing them to the is_in_or_equal function, and ensure all file paths are properly resolved and absolute to mitigate the bypass vulnerabilities.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.