CVE-2024-47166

Summary

CVE-2024-47166 is a vulnerability affecting the Gradio open-source Python package. This issue involves a one-level read path traversal in the `/custom_component` endpoint, allowing attackers to access and leak source code from custom Gradio components. Though the traversal is limited to a single directory level, it could potentially expose sensitive or proprietary code. Users who have developed custom Gradio components and host them on publicly accessible servers are at risk. To mitigate this vulnerability, it is recommended to upgrade to `gradio>=4.44` or to sanitize file paths and ensure components are not stored in publicly accessible directories.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.