CVE-2023-51449
Published: 22 December 2023
Summary
CVE-2023-51449 is a medium-severity Path Traversal (CWE-22) vulnerability in Gradio Project Gradio. Its CVSS base score is 5.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Other Platforms; in the Privacy and Disclosure risk domain; MITRE ATLAS techniques in scope: Obtain Capabilities (AML.T0016), Exfiltration via AI Inference API (AML.T0024).
Deeper analysis
Gradio is an open-source Python package used to build web demos and applications for machine learning models and arbitrary Python functions. Versions prior to 4.11.0 contain a path traversal vulnerability (CWE-22) in the /file route that allows unauthorized access to files on the host system when the application is exposed via a public URL, such as those generated with share=True or hosted on Hugging Face Spaces. The flaw received a CVSS 5.6 rating reflecting network attack vector, high attack complexity, and limited impact to confidentiality, integrity, and availability.
An unauthenticated remote attacker who knows or can guess file paths on the target system can exploit the /file endpoint to read arbitrary files. Successful exploitation is limited to Gradio instances reachable over the internet and does not require user interaction or authentication, but the high complexity stems from the need to identify specific file locations.
The vulnerability was addressed in Gradio 4.11.0. Official patches are documented in commits 1b9d4234d6c25ef250d882c7b90e1f4039ed2d76 and 7ba8c5da45b004edd12c0460be9222f5b5f5f055, and the GitHub Security Advisory GHSA-6qm2-wpxq-7qh2 recommends upgrading to the fixed release.
The affected software is commonly used in machine-learning workflows, increasing the potential blast radius when demos are shared publicly. EPSS scores have remained stable near 0.81 with no material change after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-0089
Vulnerability details
Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file`…
more
route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Other Platforms
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Gradio is an open-source Python package for building web demos and applications for machine learning models, APIs, or Python functions, commonly used in AI/ML deployment scenarios like Hugging Face Spaces.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in /file route enables arbitrary local file reads (T1005, T1083). SSRF enables internal network service discovery (T1046). Vulnerability exploited via public-facing web app (T1190).
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.