CVE-2024-12065 Overview
CVE-2024-12065 is a local file inclusion (LFI) vulnerability in haotian-liu/llava at commit c121f04. The flaw resides in the Gradio web UI component, which fails to properly validate user-supplied input. Attackers can send multiple crafted requests to the server and read arbitrary files from the underlying host. The vulnerability is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory) and affects the LLaVA multimodal model project maintained by hliu. Exploitation requires no authentication and can be performed remotely across the network.
Critical Impact
Unauthenticated remote attackers can read sensitive files including configuration data, credentials, and application source code by abusing path traversal in the Gradio interface.
Affected Products
- haotian-liu/llava at commit c121f04
- LLaVA build dated 2024-05-11 (cpe:2.3:a:hliu:llava:2024-05-11)
- Deployments exposing the Gradio web UI component
Discovery Timeline
- 2025-03-20 - CVE-2024-12065 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-12065
Vulnerability Analysis
The vulnerability affects the Gradio web UI shipped with LLaVA, a large multimodal model project. Gradio exposes HTTP endpoints that accept file references for serving assets to the browser. In the vulnerable commit, these endpoints do not enforce a strict allow-list or canonicalization of the requested file path.
An attacker can chain multiple crafted requests to bypass the runtime path checks and reach files outside the intended served directory. The response returns the raw file contents to the requester. Sensitive targets include /etc/passwd, SSH private keys under ~/.ssh/, application secrets, and model configuration files.
Because LLaVA is often deployed on GPU inference hosts that also hold API tokens and cloud credentials, disclosure of these files can enable follow-on compromise of adjacent systems.
Root Cause
The root cause is improper input validation on file path parameters processed by the Gradio component. The application accepts paths that include directory traversal sequences and dereferences them without confining resolution to a safe base directory.
Attack Vector
Exploitation is remote and unauthenticated. An attacker issues a sequence of HTTP requests to the exposed Gradio endpoint, supplying manipulated path parameters. The server resolves each request and returns file contents that reside outside the intended scope. See the Huntr Bug Bounty Report for the disclosure record.
No verified public exploit code is available. The vulnerability mechanism is described in prose because no sanitized proof-of-concept was released with the advisory.
Detection Methods for CVE-2024-12065
Indicators of Compromise
- HTTP requests to Gradio endpoints containing path traversal sequences such as ../, ..%2f, or URL-encoded variants targeting file parameters.
- Repeated requests from a single source enumerating filenames like /etc/passwd, id_rsa, or .env.
- Outbound egress from the LLaVA host shortly after file read requests, suggesting exfiltration.
Detection Strategies
- Inspect web server and reverse proxy logs for query strings referencing absolute paths or traversal patterns against the Gradio service.
- Deploy web application firewall (WAF) rules that flag encoded traversal sequences on endpoints hosted by the model server.
- Correlate authentication-less access to file-serving routes with unusual response sizes indicating large file reads.
Monitoring Recommendations
- Enable verbose request logging on the Gradio front end, including full URIs and response byte counts.
- Monitor filesystem access on the LLaVA process using host-based auditing such as auditd rules for reads to sensitive paths.
- Alert on network connections to the Gradio port from untrusted networks, particularly when the service is intended for internal use.
How to Mitigate CVE-2024-12065
Immediate Actions Required
- Restrict network access to the LLaVA Gradio interface using firewall rules or an authenticated reverse proxy.
- Take the vulnerable commit c121f04 offline until an upstream fix is applied.
- Rotate any credentials, API tokens, or SSH keys stored on hosts that exposed the vulnerable interface.
Patch Information
No vendor advisory URL or official patch reference is listed in the NVD entry at the time of writing. Consult the Huntr Bug Bounty Report and the upstream haotian-liu/llava repository for updated commits addressing the Gradio path validation defect.
Workarounds
- Bind the Gradio service to 127.0.0.1 and front it with an authenticated proxy that normalizes and validates file paths.
- Run the LLaVA process as a low-privilege user inside a container with a minimal read-only filesystem to limit reachable files.
- Apply WAF rules blocking traversal sequences (../, ..%2f, %2e%2e/) on all endpoints served by the model UI.
# Configuration example: restrict Gradio to localhost and enforce reverse proxy
export GRADIO_SERVER_NAME=127.0.0.1
export GRADIO_SERVER_PORT=7860
# Run LLaVA under a non-privileged user with a locked-down working directory
sudo -u llava-svc python -m llava.serve.gradio_web_server --host 127.0.0.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
