Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:LSummary
CVE-2023-51449 is a medium-severity Path Traversal (CWE-22) vulnerability in Gradio Project Gradio. Its CVSS base score is 5.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Other AI Platforms; in the Privacy and Disclosure risk domain.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Gradio is an open-source Python package used to build web demos and applications for machine learning models and arbitrary Python functions. Versions prior to 4.11.0 contain a path traversal vulnerability (CWE-22) in the /file route that allows unauthorized access to files on the host system when the application is exposed via a public URL, such as those generated with share=True or hosted on Hugging Face Spaces. The flaw received a CVSS 5.6 rating reflecting network attack vector, high attack complexity, and limited impact to confidentiality, integrity, and availability.
An unauthenticated remote attacker who knows or can guess file paths on the target system can exploit the /file endpoint to read arbitrary files. Successful exploitation is limited to Gradio instances reachable over the internet and does not require user interaction or authentication, but the high complexity stems from the need to identify specific file locations.
The vulnerability was addressed in Gradio 4.11.0. Official patches are documented in commits 1b9d4234d6c25ef250d882c7b90e1f4039ed2d76 and 7ba8c5da45b004edd12c0460be9222f5b5f5f055, and the GitHub Security Advisory GHSA-6qm2-wpxq-7qh2 recommends upgrading to the fixed release.
The affected software is commonly used in machine-learning workflows, increasing the potential blast radius when demos are shared publicly. EPSS scores have remained stable near 0.81 with no material change after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-0089
Vulnerability Data
Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file`…
more
route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Other AI Platforms
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Gradio is an open-source Python package for building web demos and applications for machine learning models, APIs, or Python functions, commonly used in AI/ML deployment scenarios like Hugging Face Spaces.
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches path traversal via static/dynamic analysis.
Secure SDLC mandates input validation and path sanitization that directly prevent path traversal.
Application security requirements include rules for safe file handling and canonicalization.
Secure architecture principles require least-privilege file access and directory isolation.
Secure coding standards explicitly forbid unsafe path construction and mandate safe APIs.
Information access restriction limits which files an application may read or write.