https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T11:40:23.634303+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-12217 CVE-2024-12217 — Path Traversal in gradio-app/gradio 2026-10-03T11:40:23.668209+00:00

Affected: gradio-app/gradio

A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application correctly blocks access to paths like 'C:/tmp/secret.txt', it fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA'. This flaw can lead to unauthorized reading of blocked file paths.

 https://cve.radiocsirt.org/vuln/ghsa-prpg-p95c-32fv GHSA-prpg-p95c-32fv — Gradio Path Traversal vulnerability 2026-10-03T11:40:23.668280+00:00

Affected: PyPI: gradio

A vulnerability in the gradio-app/gradio repository, version git 67e4044, allows for path traversal on Windows OS. The implementation of the blocked_path functionality, which is intended to disallow users from reading certain files, is flawed. Specifically, while the application correctly blocks access to paths like 'C:/tmp/secret.txt', it fails to block access when using NTFS Alternate Data Streams (ADS) syntax, such as 'C:/tmp/secret.txt::$DATA'. This flaw can lead to unauthorized reading of blocked file paths.