CVE-2024-12217
Severity CVSS v4.0:
Pending analysis
Type:
CWE-22
Path Traversal
Publication date:
20/03/2025
Last modified:
20/03/2025
Description
A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application correctly blocks access to paths like 'C:/tmp/secret.txt', it fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA'. This flaw can lead to unauthorized reading of blocked file paths.
Impact
Base Score 3.x
5.30
Severity 3.x
MEDIUM