CVE-2023-51449

Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.

• CWE-22

• https://github.com/gradio-app/gradio/commit/1b9d4234d6c25ef250d882c7b90e1f4039ed2d76Patch
• https://github.com/gradio-app/gradio/commit/7ba8c5da45b004edd12c0460be9222f5b5f5f055Patch
• https://github.com/gradio-app/gradio/security/advisories/GHSA-6qm2-wpxq-7qh2Third Party Advisory
• https://github.com/gradio-app/gradio/commit/1b9d4234d6c25ef250d882c7b90e1f4039ed2d76Patch
• https://github.com/gradio-app/gradio/commit/7ba8c5da45b004edd12c0460be9222f5b5f5f055Patch
• https://github.com/gradio-app/gradio/security/advisories/GHSA-6qm2-wpxq-7qh2Third Party Advisory

Published

Dec 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-51443FreeSWITCH is a Software Defined Telecom Stack enabling the …5.9
• CVE-2023-51444GeoServer is an open source software server written in Java …7.2
• CVE-2023-51445GeoServer is an open source software server written in Java …4.8
• CVE-2023-51446GLPI is a Free Asset and IT Management Software package. Whe…8.1
• CVE-2023-51447Decidim is a participatory democracy framework. Starting in …5.4
• CVE-2023-51448Cacti provides an operational monitoring and fault managemen…8.8
• CVE-2023-5145** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been fou…8.8
• CVE-2023-51450baserCMS is a website development framework. Prior to versio…8.1
• CVE-2023-51451Symbolicator is a service used in Sentry. Starting in Symbol…4.3
• CVE-2023-51452A Improper Input Validation issue affecting the v2_sdk_servi…3
• CVE-2023-51453A Improper Input Validation issue affecting the v2_sdk_servi…3
• CVE-2023-51454A Out-of-bounds Write issue affecting the v2_sdk_service run…6.8