CVE-2024-31462

Summary

CVE-2024-31462 is a vulnerability affecting the stable-diffusion-webui, a web interface for Stable Diffusion that uses Gradio library. In version 1.7.0, a limited file write vulnerability exists on Windows systems. The issue arises from the create_ui method in modules/ui_extensions.py, where user input is taken in the config_save_name variable on line 653. This data is later utilized in the save_config_state method and used to construct a file path on line 65, which is subsequently opened for writing on line 67. This vulnerability enables an attacker to write JSON files anywhere on the server where the web server has access, leading to potential security risks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.