CVE-2024-1728: Arbitrary File Access in Gradio

The primary impact of CVE-2024-1728 is unauthorized file access. Attackers can intercept and modify network requests made by the Gradio application to the server, enabling them to retrieve sensitive data stored on the host machine. This could include configuration files, API keys, source code, or other confidential information. The potential blast radius is significant, particularly for Gradio applications deployed in public environments like Hugging Face Spaces, as these applications are inherently accessible to a wide range of users. While there is no current evidence of active exploitation, the ease of exploitation makes this a high-priority concern.

1. Reserved2024-02-21
2. Published2024-09-25
3. Modified2026-02-03
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-1728 is to upgrade Gradio to version 4.19.2 or higher. This patched version includes fixes to prevent the unauthorized file access. If upgrading is not immediately feasible, consider implementing network-level restrictions to limit access to the Gradio application's file system. WAF rules can be configured to block suspicious requests that attempt to access files outside of the intended application directory. Carefully review and restrict file permissions on the server hosting the Gradio application to minimize the potential impact of a successful exploit. After upgrading, confirm the fix by attempting to access files outside the intended application directory through the Gradio interface; access should be denied.