{"id":"CVE-2024-1728","kind":"vulnerability","aliases":["CVE-2024-1728","GHSA-m842-4qm8-7gpq"],"related":[],"title":"Gradio allows users to access arbitrary files","description":"### Impact\nThis vulnerability allows users of Gradio applications that have a public link (such as on Hugging Face Spaces) to access files on the machine hosting the Gradio application. This involves intercepting and modifying the network requests made by the Gradio app to the server. \n\n### Patches\nYes, the problem has been patched in Gradio version 4.19.2 or higher. We have no knowledge of this exploit being used against users of Gradio applications, but we encourage all users to upgrade to Gradio 4.19.2 or higher.\n\nFixed in: https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7\nCVE: https://nvd.nist.gov/vuln/detail/CVE-2024-1728","summary":"Gradio applications exposed through a public link, such as on Hugging Face Spaces, let users read arbitrary files from the machine hosting the app. An attacker can intercept and modify the app's network requests to reach files outside the intended scope.","severity":"critical","cvss":8.1,"epss":0.85393,"exploited":false,"exploited_at":null,"products":[{"name":"gradio","fixed":["4.19.2"],"affected":"< 4.19.2","ecosystem":"pypi"},{"name":"gradio project gradio","fixed":["4.19.2"],"affected":">= 4.18.0, < 4.19.2","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["cwe-22","gradio","hugging-face-spaces","package","python","self-hosted"],"not_affected_if":["already-on-4.19.2-or-higher","local-only-network"],"how_to_check":"- Run `pip show gradio` and compare the version against `4.19.2`\n- Check whether the app is launched with a public share link or hosted on Hugging Face Spaces","fix":"- Upgrade the `gradio` package to `4.19.2` or higher\n- Redeploy the app after upgrading","status":"open","published_at":"2024-04-10T17:15:53+00:00","first_seen_at":"2026-10-27T16:35:55+00:00","triaged_at":"2026-10-27T16:38:08+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T16:38:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `gradio` package to `4.19.2` or higher\n- Redeploy the app after upgrading","reach":"internet","title":"Gradio: path traversal lets public-link users read server files","impact":"high","summary":"Gradio applications exposed through a public link, such as on Hugging Face Spaces, let users read arbitrary files from the machine hosting the app. An attacker can intercept and modify the app's network requests to reach files outside the intended scope.","category":"package","nicknames":[],"who_cares":["python","gradio","hugging-face-spaces","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads arbitrary files from the server hosting the app","analyst_note":"","how_to_check":"- Run `pip show gradio` and compare the version against `4.19.2`\n- Check whether the app is launched with a public share link or hosted on Hugging Face Spaces","needs_analyst":false,"not_affected_if":["already-on-4.19.2-or-higher","local-only-network"],"who_is_affected":"Gradio applications that are reachable through a public link, such as a share link or a Hugging Face Space, are exposed because the file access path can be reached from outside. Apps only reachable on a private network or locally are less exposed, but the sources do not say how far that reduces risk. Teams already on 4.19.2 or higher are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000608,"input_tokens":3508,"output_tokens":514,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-1728':10A,18A '-2024':9A,17A '-22':24B '/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7':165C '/vuln/detail/cve-2024-1728':169C '4.19.2':132C,158C '4qm8':14A '7gpq':15A 'access':5A,97C 'allow':2A,80C 'app':58B,66B,118C 'applic':36B,84C,105C,148C 'arbitrari':6A,51B 'attack':60B 'cve':8A,16A,166C 'cwe':23B 'encourag':151C 'exploit':141C 'expos':37B 'face':28B,46B,94C 'file':7A,52B,72B,98C 'fix':161C 'ghsa':12A 'ghsa-m842-4qm8-7gpq':11A 'github.com':164C 'github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7':163C 'gradio':1A,19A,20A,22A,25B,35B,83C,104C,117C,130C,147C,157C 'higher':134C,160C 'host':34B,56B,102C 'hug':27B,45B,93C 'hugging-face-spac':26B 'impact':77C 'intend':75B 'intercept':62B,108C 'involv':107C 'knowledg':138C 'let':48B 'link':41B,89C 'm842':13A 'machin':55B,101C 'made':114C 'modifi':64B,110C 'network':68B,112C 'nvd.nist.gov':168C 'nvd.nist.gov/vuln/detail/cve-2024-1728':167C 'outsid':73B 'packag':30B 'patch':122C,128C 'problem':125C 'project':21A 'public':40B,88C 'python':31B 'reach':71B 'read':50B 'request':69B,113C 'scope':76B 'self':33B 'self-host':32B 'server':121C 'space':29B,47B,95C 'upgrad':155C 'use':143C 'user':3A,49B,81C,145C,153C 'version':131C 'vulner':79C 'yes':123C","nicknames":[],"mitigations":[],"who_affected":"Gradio applications that are reachable through a public link, such as a share link or a Hugging Face Space, are exposed because the file access path can be reached from outside. Apps only reachable on a private network or locally are less exposed, but the sources do not say how far that reduces risk. Teams already on 4.19.2 or higher are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-04-10T17:15:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-m842-4qm8-7gpq","url":"https://github.com/advisories/GHSA-m842-4qm8-7gpq","severity":"critical","published_at":"2024-09-25T21:48:24+00:00","modified_at":"2026-10-27T16:34:18+00:00","first_seen_at":"2026-10-27T16:35:55+00:00","fetched_at":"2026-10-27T16:35:55+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-1728","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1728","severity":null,"published_at":"2024-04-10T17:15:53+00:00","modified_at":"2026-06-17T07:04:52+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}