Path Traversal in gradio-app/gradio
A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application correctly blocks access to paths like 'C:/tmp/secret.txt', it fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA'. This flaw can lead to unauthorized reading of blocked file paths.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-22 | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
Type: CWE
Description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 3.0 | 5.3 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Version: 3.0
Base score: 5.3
Base severity: MEDIUM
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N