CVE-2024-47868

Summary

CVE-2024-47868 is a data validation vulnerability in the open-source Python package Gradio, affecting several components that handle file data. Attackers can exploit this issue by crafting requests that bypass expected input constraints, potentially leading to arbitrary file leaks and exposure of sensitive information. Components most at risk include DownloadButton, Audio, ImageEditor, Video, Model3D, File, UploadButton, Chatbot, MultimodalTextbox, Code, and ParamViewer. For instance, an attacker could bypass input constraints on a DownloadButton and download sensitive files, or leak files through a malicious payload in a ParamViewer component. No known workarounds exist, but upgrading to Gradio version 5.0 or later will mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.