LFI in Gradio

CVE-2024-0964

What is CVE-2024-0964?

A local file inclusion vulnerability exists in the Gradio API that can be exploited remotely. The issue occurs when the application processes a user-supplied JSON value in API requests, potentially allowing malicious actors to include files from the server filesystem. This vulnerability highlights the necessity for proper input validation and sanitization in API endpoints, emphasizing the risk of allowing uncontrolled user inputs to influence application behavior.

References