One-level read path traversal in `/custom_component` in Gradio (CVE-2024-47166)
A one-level read path traversal vulnerability in Gradio's `/custom_component` endpoint allows attackers to access and leak source code from custom Gradio components by manipulating file paths. The flaw affects Gradio versions before 4.44 and impacts developers hosting custom components on publicly accessible servers.
What happened
A one-level read path traversal vulnerability was identified in the /custom_component endpoint of Gradio. Attackers can exploit this flaw by manipulating the file path in requests to access and leak source code from custom Gradio components.
Reported impact
The vulnerability impacts developers who have created custom Gradio components and are hosting them on publicly accessible servers. Proprietary or sensitive code that developers intended to keep private could be exposed.
Index analysis
The vulnerability is classified as low severity and is limited to a single directory level of path traversal.
Governance controls
Gradio released a patched version 4.44 to address the issue. Developers can mitigate the vulnerability without upgrading by sanitizing file paths and ensuring components are not stored in publicly accessible directories.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.