CVE-2024-10648 Overview
CVE-2024-10648 is a path traversal vulnerability in the Gradio Audio component of gradio-app/gradio at commit 98cbcae. The flaw allows a remote unauthenticated attacker to control the output format of an audio file. By manipulating this format parameter, the attacker can target arbitrary files on the server and reset their contents to empty. The result is arbitrary file content deletion and denial of service (DoS) against the hosting server. The vulnerability is classified under CWE-29: Path Traversal: \..\filename.
Critical Impact
Unauthenticated network attackers can wipe arbitrary files on a Gradio host, causing denial of service and data loss.
Affected Products
- gradio-app/gradio Python package (commit 98cbcae)
- Gradio version dated 2024-09-18
- Any Gradio application exposing the Audio component to untrusted input
Discovery Timeline
- 2025-03-20 - CVE-2024-10648 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10648
Vulnerability Analysis
Gradio is a Python framework for building web interfaces around machine learning models. The Audio component accepts an output format parameter that determines how audio files are written to disk. The component fails to validate or sanitize this format value before using it to construct a file path.
An attacker can supply a crafted format string that traverses out of the intended output directory. The Audio processing routine then opens the target file for writing and truncates it. Any file readable and writable by the Gradio process can be emptied through this mechanism.
The impact is limited to integrity and availability. The vulnerability does not directly disclose file contents, but wiping configuration files, model weights, databases, or system binaries causes service disruption and data loss.
Root Cause
The root cause is missing input validation on the audio output format parameter. The Gradio Audio component treats attacker-controlled input as a trusted path component. It does not enforce a whitelist of allowed formats such as wav, mp3, or flac. It also does not canonicalize the resulting path or confirm the write target resides within an approved directory.
Attack Vector
Exploitation requires network access to a Gradio application that exposes the vulnerable Audio component. No authentication or user interaction is required. The attacker submits a request that sets the audio output format to a traversal sequence pointing at a target file path. Gradio processes the request server-side and truncates the referenced file. Repeated calls can be used to disable applications, delete logs, or destroy artifacts.
See the Huntr bounty listing for technical details on the exploitation path.
Detection Methods for CVE-2024-10648
Indicators of Compromise
- Zero-byte files in application, configuration, or model directories that previously contained data
- Gradio process writes to paths outside its configured working or temporary directories
- HTTP requests to Gradio endpoints where the audio format parameter contains .., /, \, or absolute path characters
- Unexpected truncation of log files, database files, or Python source files owned by the Gradio service user
Detection Strategies
- Inspect web server and reverse proxy logs for requests to Gradio Audio endpoints containing path separators or traversal sequences in format fields
- Monitor file integrity on directories adjacent to the Gradio working directory for sudden size drops to zero bytes
- Correlate Gradio process file write syscalls with file paths outside the expected output directory using EDR telemetry
Monitoring Recommendations
- Enable audit logging (auditd on Linux) for open() and truncate() calls performed by the Gradio process
- Alert on Gradio HTTP request bodies containing suspicious format values such as ../, ..\, or paths beginning with /
- Track Gradio version and commit hash across deployments to identify hosts still running vulnerable builds
How to Mitigate CVE-2024-10648
Immediate Actions Required
- Upgrade Gradio to a version released after commit 98cbcae that includes the format validation fix
- Restrict network exposure of Gradio applications behind authentication and IP allow-lists until patched
- Run Gradio under a dedicated low-privilege user account with write access limited to a scoped output directory
- Audit hosts for zero-byte files created after Gradio was first exposed to untrusted traffic
Patch Information
Refer to the Huntr bounty listing for the fix commit and upstream patch details. Upgrade to the latest release of gradio-app/gradio from PyPI and verify the installed version does not correspond to the vulnerable commit 98cbcae dated 2024-09-18.
Workarounds
- Place a reverse proxy in front of Gradio that rejects requests containing path traversal sequences in body or query parameters
- Deploy Gradio inside a container or chroot with read-only mounts for all directories outside the intended audio output path
- Disable or remove the Audio component from Gradio interfaces that do not require audio processing
- Apply mandatory access controls such as AppArmor or SELinux profiles to constrain the Gradio process file write scope
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
