CVE-2024-48052

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-48052
In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability. The reason is that within the save_url_to_cache function, there are no restrictions on the URL, which allows access to local target resources. This can lead to the download of local resources and sensitive information.
CVSS

No CVSS.

References
Link Resource
https://gist.github.com/AfterSnows/45ffc23797f9127e00755376cc610e12 Third Party Advisory
https://rumbling-slice-eb0.notion.site/FULL-SSRF-in-gr-DownloadButton-in-gradio-app-gradio-870b21e0908b48cbafd914719ac1a4e6?pvs=4 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*
History

13 Jun 2025, 00:21

Type Values Removed Values Added
References () https://gist.github.com/AfterSnows/45ffc23797f9127e00755376cc610e12 - () https://gist.github.com/AfterSnows/45ffc23797f9127e00755376cc610e12 - Third Party Advisory
References () https://rumbling-slice-eb0.notion.site/FULL-SSRF-in-gr-DownloadButton-in-gradio-app-gradio-870b21e0908b48cbafd914719ac1a4e6?pvs=4 - () https://rumbling-slice-eb0.notion.site/FULL-SSRF-in-gr-DownloadButton-in-gradio-app-gradio-870b21e0908b48cbafd914719ac1a4e6?pvs=4 - Exploit, Third Party Advisory
CPE cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*
First Time Gradio Project
Gradio Project gradio

04 Nov 2024, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-04 23:15

Updated : 2025-06-13 00:21

NVD link : CVE-2024-48052

Mitre link : CVE-2024-48052

JSON object : View

Products Affected

gradio_project

  • gradio
CWE

No CWE.