A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the victim's server, an attacker can deplete the system's disk space, potentially leading to a denial of service. This issue affects the file upload functionality as implemented in gradio/routes.py.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Gradio Project |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-1407 | A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the victim's server, an attacker can deplete the system's disk space, potentially leading to a denial of service. This issue affects the file upload functionality as implemented in gradio/routes.py. |
 Github GHSA |
GHSA-48cq-79qq-6f7x | Gradio applications running locally vulnerable to 3rd party websites accessing routes and uploading files |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 30 Jul 2025 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Gradio Project
Gradio Project gradio |
|
| CPEs | cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:* | |
| Vendors & Products |
Gradio Project
Gradio Project gradio |
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2024-08-01T18:48:21.951Z
Reserved: 2024-02-21T21:55:06.942Z
Link: CVE-2024-1727
Vulnrichment
Updated: 2024-08-01T18:48:21.951Z
NVD
Status : Analyzed
Published: 2024-03-21T20:15:07.620
Modified: 2025-07-30T20:11:16.023
Link: CVE-2024-1727
Redhat
No data.
OpenCVE Enrichment
No data.