{"cve":"CVE-2024-10648","nvd":{"published":"2025-03-20T10:15:18.010","modified":"2026-06-17T06:56:07.097","status":"Analyzed","description":"A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset any file to an empty file, causing a denial of service (DOS) on the server.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","score":8.2},"cwes":["CWE-29"],"references":["https://huntr.com/bounties/667d664d-8189-458c-8ed7-483fe8f33c76"],"products":["gradio_project:gradio"],"source":"nvd","synced_at":"2026-10-19T22:00:17.429720821+00:00"},"epss":{"cve":"CVE-2024-10648","score":0.00731,"percentile":0.5432,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-pgfv-gvc5-prfg","url":"https://osv.dev/vulnerability/GHSA-pgfv-gvc5-prfg","summary":"Gradio Vulnerable to Arbitrary File Deletion","modified":"2026-07-07T17:57:24.155367189Z","packages":[{"ecosystem":"PyPI","name":"gradio","purl":"pkg:pypi/gradio","ranges":[">=4.0.0 <=5.0.0b2"],"fixed":[]}]},{"id":"PYSEC-2026-1417","url":"https://osv.dev/vulnerability/PYSEC-2026-1417","summary":"Gradio Vulnerable to Arbitrary File Deletion","modified":"2026-07-07T17:47:40.335557067Z","packages":[{"ecosystem":"PyPI","name":"gradio","purl":"pkg:pypi/gradio","ranges":[">=4.0.0 <=5.0.0b2"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}