Medium severity5.3GHSA Advisory· Published Mar 20, 2025· Updated Apr 15, 2026
CVE-2024-12217
CVE-2024-12217
Description
A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application correctly blocks access to paths like 'C:/tmp/secret.txt', it fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA'. This flaw can lead to unauthorized reading of blocked file paths.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
gradioPyPI | <= 5.0.1 | — |
Affected products
2- Range: <= 5.0.1
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.