{"cve":"CVE-2024-4941","nvd":{"published":"2024-06-06T18:15:18.783","modified":"2026-06-17T08:03:14.797","status":"Modified","description":"A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the `postprocess()` function within `gradio/components/json_component.py`, where a user-controlled string is parsed as JSON. If the parsed JSON object contains a `path` key, the specified file is moved to a temporary directory, making it possible to retrieve it later via the `/file=..` endpoint. This issue is due to the `processing_utils.move_files_to_cache()` function traversing any object passed to it, looking for a dictionary with a `path` key, and then copying the specified file to a temporary directory. The vulnerability can be exploited by an attacker to read files on the remote system, posing a significant security risk.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-22"],"references":["https://github.com/gradio-app/gradio/commit/ee1e2942e0a1ae84a08a05464e41c8108a03fa9c","https://huntr.com/bounties/39889ce1-298d-4568-aecd-7ae40c2ca58e","https://github.com/gradio-app/gradio/commit/ee1e2942e0a1ae84a08a05464e41c8108a03fa9c","https://huntr.com/bounties/39889ce1-298d-4568-aecd-7ae40c2ca58e"],"products":["gradio_project:gradio"],"source":"nvd","synced_at":"2026-10-19T21:51:20.603330631+00:00"},"epss":{"cve":"CVE-2024-4941","score":0.0083,"percentile":0.57576,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-6v6g-j5fq-hpvw","url":"https://osv.dev/vulnerability/GHSA-6v6g-j5fq-hpvw","summary":"Local file inclusion in gradio","modified":"2025-10-16T07:59:21.927382Z","packages":[{"ecosystem":"PyPI","name":"gradio","purl":"pkg:pypi/gradio","ranges":["<4.31.3"],"fixed":["4.31.3"]}]},{"id":"PYSEC-2024-184","url":"https://osv.dev/vulnerability/PYSEC-2024-184","summary":"","modified":"2026-06-10T17:01:21.040668281Z","packages":[{"ecosystem":"PyPI","name":"gradio","purl":"pkg:pypi/gradio","ranges":["<4.31.4"],"fixed":["4.31.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}