Access Control Bypass in Gradio Open-Source Python Package

CVE-2025-23042

What is CVE-2025-23042?

An access control bypass vulnerability exists in Gradio, an open-source Python package for machine learning applications. The flaw stems from inadequate case normalization in the file path validation logic, which allows attackers on case-insensitive file systems to bypass security restrictions. By manipulating the case of blocked file or directory paths, unauthorized users can gain access to sensitive files, undermining the application's security model. This vulnerability could expose critical information, especially in production environments utilizing Gradio for machine learning or AI applications. Users are encouraged to upgrade to version 5.6.0 or later as there are no known workarounds.

References