Local File Inclusion Vulnerability in gradio-app/gradio version 4.25

CVE-2024-4941

What is CVE-2024-4941?

A local file inclusion vulnerability affects the JSON component of Gradio version 4.25, originating from inadequate input validation in the postprocess() function found in gradio/components/json_component.py. The flaw allows a user-controlled string to be parsed as JSON, which, if it contains a path key, leads to the movement of the associated file into a temporary directory. This is performed by the processing_utils.move_files_to_cache() function, which traverses the provided object in search of a dictionary containing a path key. Consequently, an attacker can exploit this weakness to access files on the remote system, presenting a notable security threat.

References