Cyber Resilience

CVE-2023-51449

Medium

Published: 22 December 2023

Published
22 December 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.8149 99.2th percentile
Risk Priority 60 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-51449 is a medium-severity Path Traversal (CWE-22) vulnerability in Gradio Project Gradio. Its CVSS base score is 5.6 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Other Platforms; in the Privacy and Disclosure risk domain; MITRE ATLAS techniques in scope: Obtain Capabilities (AML.T0016), Exfiltration via AI Inference API (AML.T0024).

Deeper analysis

Gradio is an open-source Python package used to build web demos and applications for machine learning models and arbitrary Python functions. Versions prior to 4.11.0 contain a path traversal vulnerability (CWE-22) in the /file route that allows unauthorized access to files on the host system when the application is exposed via a public URL, such as those generated with share=True or hosted on Hugging Face Spaces. The flaw received a CVSS 5.6 rating reflecting network attack vector, high attack complexity, and limited impact to confidentiality, integrity, and availability.

An unauthenticated remote attacker who knows or can guess file paths on the target system can exploit the /file endpoint to read arbitrary files. Successful exploitation is limited to Gradio instances reachable over the internet and does not require user interaction or authentication, but the high complexity stems from the need to identify specific file locations.

The vulnerability was addressed in Gradio 4.11.0. Official patches are documented in commits 1b9d4234d6c25ef250d882c7b90e1f4039ed2d76 and 7ba8c5da45b004edd12c0460be9222f5b5f5f055, and the GitHub Security Advisory GHSA-6qm2-wpxq-7qh2 recommends upgrading to the fixed release.

The affected software is commonly used in machine-learning workflows, increasing the potential blast radius when demos are shared publicly. EPSS scores have remained stable near 0.81 with no material change after disclosure.

EU & UK References

Vulnerability details

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file`…

more

route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.

CWE(s)

AI Security AnalysisAI

AI Category
Other Platforms
Risk Domain
Privacy and Disclosure
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Gradio is an open-source Python package for building web demos and applications for machine learning models, APIs, or Python functions, commonly used in AI/ML deployment scenarios like Hugging Face Spaces.

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1046 Network Service Discovery Discovery
Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Path traversal in /file route enables arbitrary local file reads (T1005, T1083). SSRF enables internal network service discovery (T1046). Vulnerability exploited via public-facing web app (T1190).

MITRE ATLAS TechniquesAI

MITRE ATLAS techniques

AML.T0016: Obtain CapabilitiesAML.T0024: Exfiltration via AI Inference API

Affected Assets

gradio project
gradio
≤ 4.11.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

References