id: PYSEC-2026-1417
published: "2026-07-07T14:34:51.739857Z"
modified: "2026-07-07T17:24:13.615702Z"
aliases:
- CVE-2024-10648
- GHSA-pgfv-gvc5-prfg
summary: Gradio Vulnerable to Arbitrary File Deletion
details: A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to control the format of the audio file, leading to arbitrary file content deletion. By manipulating the output format, an attacker can reset any file to an empty file, causing a denial of service (DOS) on the server.
affected:
- package:
    name: gradio
    ecosystem: PyPI
    purl: pkg:pypi/gradio
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 4.0.0
    - last_affected: 5.0.0b2
  versions:
  - 4.0.0
  - 4.0.1
  - 4.0.2
  - 4.1.0
  - 4.1.1
  - 4.1.2
  - 4.10.0
  - 4.11.0
  - 4.12.0
  - 4.13.0
  - 4.14.0
  - 4.15.0
  - 4.16.0
  - 4.17.0
  - 4.18.0
  - 4.19.0
  - 4.19.1
  - 4.19.2
  - 4.2.0
  - 4.20.0
  - 4.20.1
  - 4.21.0
  - 4.22.0
  - 4.23.0
  - 4.24.0
  - 4.25.0
  - 4.26.0
  - 4.27.0
  - 4.28.0
  - 4.28.1
  - 4.28.2
  - 4.28.3
  - 4.29.0
  - 4.3.0
  - 4.31.0
  - 4.31.1
  - 4.31.2
  - 4.31.3
  - 4.31.4
  - 4.31.5
  - 4.32.0
  - 4.32.1
  - 4.32.2
  - 4.33.0
  - 4.35.0
  - 4.36.0
  - 4.36.1
  - 4.37.1
  - 4.37.2
  - 4.38.0
  - 4.38.1
  - 4.39.0
  - 4.4.0
  - 4.4.1
  - 4.40.0
  - 4.41.0
  - 4.42.0
  - 4.43.0
  - 4.44.0
  - 4.44.1
  - 4.5.0
  - 4.7.0
  - 4.7.1
  - 4.8.0
  - 4.9.0
  - 4.9.1
  - 5.0.0b1
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2024-10648
- type: PACKAGE
  url: https://github.com/gradio-app/gradio
- type: WEB
  url: "https://github.com/gradio-app/gradio/blame/98cbcaef827de7267462ccba180c7b2ffb1e825d/gradio/processing_utils.py#L234"
- type: WEB
  url: https://huntr.com/bounties/667d664d-8189-458c-8ed7-483fe8f33c76
- type: PACKAGE
  url: https://pypi.org/project/gradio
- type: ADVISORY
  url: https://github.com/advisories/GHSA-pgfv-gvc5-prfg
severity:
- type: CVSS_V3
  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H