CVE-2021-43831: Files on the host computer can be accessed from the Gradio interface
Summary
CVE-2021-43831: Files on the host computer can be accessed from the Gradio interface. Affects gradio versions < 2.5.0. Fixed in 2.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gradio is a Python library that allows users to quickly create customizable UI components for machine learning models. It provides a simple interface for creating interactive interfaces and sharing them with others. However, versions of Gradio prior to 2.5.0 were vulnerable to a security issue that allowed files on the host computer to be accessed from the Gradio interface. This vulnerability could potentially expose sensitive files to attackers if they knew the exact relative filepath. It is important for users of Gradio to be aware of this vulnerability and take appropriate actions to mitigate the risk.
Vulnerability Detail
The vulnerability in Gradio versions prior to 2.5.0 allowed an attacker to access files on the host computer through the Gradio interface. When a user generated a public Gradio link and shared it with others, the files on the computer that generated the link could be exposed while the link was active. An attacker could view the contents of a file on the computer if they knew the exact relative filepath. Although there is no evidence of exploitation, the potential impact of this vulnerability is significant. The issue was promptly addressed by the Gradio team, and a patch was released in version 2.5.0 to mitigate the vulnerability.
How To Fix
Latest published version: 6.30.0 as of 22 Oct 2026
pip install --upgrade "gradio==6.30.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5.0
This is the first release that contains the fix.
pip install --upgrade "gradio==2.5.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Gradio versions prior to 2.5.0 allowed files on the host computer to be accessed through the Gradio interface. This could potentially expose sensitive information to attackers. Users of Gradio should upgrade to version 2.5.0 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gradio →
FAQ
Gradio is a Python library for creating customizable UI components for machine learning models.
The vulnerability allows files on the host computer to be accessed through the Gradio interface, potentially exposing sensitive information.
There is no evidence of exploitation, but it is important to upgrade to the patched version to mitigate the risk.
To fix the vulnerability, upgrade to Gradio version 2.5.0 or later.
No, upgrading to the patched version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for gradio.
