CVE-2024-1728: 
Gradio vulnerability analysis and mitigation

A local file inclusion vulnerability (CVE-2024-1728) was discovered in gradio-app/gradio's UploadButton component. The vulnerability stems from improper validation of user-supplied input, allowing attackers to read arbitrary files on the filesystem by manipulating file paths in requests to the /queue/join endpoint (NVD, Red Hat CVE).

The vulnerability exists in the handling of file upload paths in the UploadButton component. Attackers can exploit this by manipulating the file path in requests to the /queue/join endpoint, potentially accessing sensitive files like private SSH keys. The issue could potentially escalate to remote code execution due to the ability to redirect file uploads to unintended locations on the server (NVD).

The vulnerability allows unauthorized access to arbitrary files on the filesystem, including sensitive files such as private SSH keys. Additionally, there is potential for remote code execution through manipulation of file upload paths (NVD).

The vulnerability can be exploited by manipulating file paths in requests to the /queue/join endpoint, specifically targeting the UploadButton component's file handling mechanism (NVD).

A fix has been implemented in the gradio-app/gradio repository through a commit that prevents components from working with non-uploaded files (GitHub Commit).