Gradio UploadButton Component Vulnerable to Local File Inclusion

CVE-2024-1728

What is CVE-2024-1728?

Gradio, a popular framework for building machine learning applications, has a local file inclusion vulnerability resulting from inadequate validation of user-supplied input within the UploadButton component. This flaw enables attackers to exploit the system by crafting malicious requests that manipulate the file path directed to the /queue/join endpoint. As a consequence, arbitrary files on the server's filesystem can be accessed, including sensitive files like private SSH keys. This vulnerability highlights critical weaknesses in the file upload process, as it permits unintended file redirections, potentially paving the way for more severe attacks, including remote code execution.

References