CVE-2025-48889

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-48889

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48889.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-48889

Aliases

Published

2025-05-30T06:12:32.703Z

Modified

2026-08-12T03:51:20.655535688Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Gradio Allows Unauthorized File Copy via Path Manipulation

Details

Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Prior to version 5.31.0, an arbitrary file copy vulnerability in Gradio's flagging feature allows unauthenticated attackers to copy any readable file from the server's filesystem. While attackers can't read these copied files, they can cause DoS by copying large files (like /dev/urandom) to fill disk space. This issue has been patched in version 5.31.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48889.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-434"
    ]
}

References

Affected packages

Git / github.com/gradio-app/gradio

Affected ranges

Type

GIT

Repo

https://github.com/gradio-app/gradio

Events

Introduced

73188fb5ddb934fff10339f3c08fcbed291f2133

Fixed

16c9b246f714c03a2ece8f96515f55636700dc27

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.31.0"
        },
        {
            "introduced": "5.25.2"
        }
    ]
}

Affected versions

@gradio/accordion@0.*

@gradio/accordion@0.5.14

@gradio/accordion@0.5.15

@gradio/annotatedimage@0.*

@gradio/annotatedimage@0.9.17

@gradio/annotatedimage@0.9.18

@gradio/annotatedimage@0.9.19

@gradio/atoms@0.*

@gradio/atoms@0.16.0

@gradio/atoms@0.16.1

@gradio/audio@0.*

@gradio/audio@0.17.11

@gradio/audio@0.17.12

@gradio/audio@0.17.13

@gradio/audio@0.17.14

@gradio/box@0.*

@gradio/box@0.2.18

@gradio/box@0.2.19

@gradio/button@0.*

@gradio/button@0.4.16

@gradio/button@0.4.17

@gradio/button@0.4.18

@gradio/button@0.5.0

@gradio/chatbot@0.*

@gradio/chatbot@0.26.2

@gradio/chatbot@0.26.3

@gradio/chatbot@0.26.4

@gradio/chatbot@0.26.5

@gradio/chatbot@0.26.6

@gradio/chatbot@0.26.7

@gradio/checkbox@0.*

@gradio/checkbox@0.4.20

@gradio/checkbox@0.4.21

@gradio/checkboxgroup@0.*

@gradio/checkboxgroup@0.6.20

@gradio/checkboxgroup@0.6.21

@gradio/client@1.*

@gradio/client@1.15.0

@gradio/code@0.*

@gradio/code@0.14.2

@gradio/code@0.14.3

@gradio/code@0.14.4

@gradio/colorpicker@0.*

@gradio/colorpicker@0.4.20

@gradio/colorpicker@0.4.21

@gradio/core@0.*

@gradio/core@0.14.1

@gradio/core@0.15.0

@gradio/core@0.15.1

@gradio/core@0.16.0

@gradio/core@0.16.1

@gradio/core@0.17.0

@gradio/dataframe@0.*

@gradio/dataframe@0.17.10

@gradio/dataframe@0.17.11

@gradio/dataframe@0.17.12

@gradio/dataframe@0.17.8

@gradio/dataframe@0.17.9

@gradio/dataset@0.*

@gradio/dataset@0.4.16

@gradio/dataset@0.4.17

@gradio/dataset@0.4.18

@gradio/dataset@0.4.19

@gradio/datetime@0.*

@gradio/datetime@0.3.12

@gradio/datetime@0.3.13

@gradio/downloadbutton@0.*

@gradio/downloadbutton@0.3.16

@gradio/downloadbutton@0.3.17

@gradio/downloadbutton@0.3.18

@gradio/downloadbutton@0.4.0

@gradio/dropdown@0.*

@gradio/dropdown@0.9.20

@gradio/dropdown@0.9.21

@gradio/fallback@0.*

@gradio/fallback@0.4.20

@gradio/fallback@0.4.21

@gradio/file@0.*

@gradio/file@0.12.16

@gradio/file@0.12.17

@gradio/file@0.12.18

@gradio/fileexplorer@0.*

@gradio/fileexplorer@0.5.27

@gradio/fileexplorer@0.5.28

@gradio/fileexplorer@0.5.29

@gradio/form@0.*

@gradio/form@0.2.18

@gradio/form@0.2.19

@gradio/gallery@0.*

@gradio/gallery@0.15.16

@gradio/gallery@0.15.17

@gradio/gallery@0.15.18

@gradio/gallery@0.15.19

@gradio/highlightedtext@0.*

@gradio/highlightedtext@0.9.3

@gradio/highlightedtext@0.9.4

@gradio/html@0.*

@gradio/html@0.6.11

@gradio/html@0.6.12

@gradio/html@0.6.13

@gradio/image@0.*

@gradio/image@0.22.3

@gradio/image@0.22.4

@gradio/image@0.22.5

@gradio/image@0.22.6

@gradio/imageeditor@0.*

@gradio/imageeditor@0.14.2

@gradio/imageeditor@0.14.3

@gradio/imageeditor@0.14.4

@gradio/imageeditor@0.14.5

@gradio/imageeditor@0.15.0

@gradio/imageslider@0.*

@gradio/imageslider@0.2.0

@gradio/imageslider@0.2.1

@gradio/imageslider@0.2.2

@gradio/json@0.*

@gradio/json@0.5.20

@gradio/json@0.5.21

@gradio/json@0.5.22

@gradio/label@0.*

@gradio/label@0.5.12

@gradio/label@0.5.13

@gradio/lite@5.*

@gradio/lite@5.26.0

@gradio/lite@5.27.0

@gradio/lite@5.27.1

@gradio/lite@5.28.0

@gradio/lite@5.29.0

@gradio/lite@5.30.0

@gradio/markdown@0.*

@gradio/markdown@0.13.10

@gradio/markdown@0.13.11

@gradio/markdown@0.13.12

@gradio/model3d@0.*

@gradio/model3d@0.14.11

@gradio/model3d@0.14.12

@gradio/model3d@0.14.13

@gradio/multimodaltextbox@0.*

@gradio/multimodaltextbox@0.10.3

@gradio/multimodaltextbox@0.10.4

@gradio/multimodaltextbox@0.10.5

@gradio/multimodaltextbox@0.10.6

@gradio/nativeplot@0.*

@gradio/nativeplot@0.5.14

@gradio/nativeplot@0.5.15

@gradio/nativeplot@0.5.16

@gradio/number@0.*

@gradio/number@0.5.20

@gradio/number@0.5.21

@gradio/paramviewer@0.*

@gradio/paramviewer@0.7.8

@gradio/paramviewer@0.7.9

@gradio/plot@0.*

@gradio/plot@0.9.15

@gradio/plot@0.9.16

@gradio/radio@0.*

@gradio/radio@0.7.3

@gradio/radio@0.7.4

@gradio/sidebar@0.*

@gradio/sidebar@0.1.12

@gradio/sidebar@0.1.13

@gradio/simpledropdown@0.*

@gradio/simpledropdown@0.3.20

@gradio/simpledropdown@0.3.21

@gradio/simpleimage@0.*

@gradio/simpleimage@0.8.27

@gradio/simpleimage@0.8.28

@gradio/simpleimage@0.8.29

@gradio/simpletextbox@0.*

@gradio/simpletextbox@0.3.20

@gradio/simpletextbox@0.3.21

@gradio/sketchbox@0.*

@gradio/sketchbox@0.6.7

@gradio/sketchbox@0.6.8

@gradio/slider@0.*

@gradio/slider@0.6.8

@gradio/slider@0.6.9

@gradio/statustracker@0.*

@gradio/statustracker@0.10.10

@gradio/statustracker@0.10.11

@gradio/tabitem@0.*

@gradio/tabitem@0.4.4

@gradio/tabs@0.*

@gradio/tabs@0.4.4

@gradio/textbox@0.*

@gradio/textbox@0.10.10

@gradio/textbox@0.10.11

@gradio/upload@0.*

@gradio/upload@0.16.3

@gradio/upload@0.16.4

@gradio/upload@0.16.5

@gradio/uploadbutton@0.*

@gradio/uploadbutton@0.8.16

@gradio/uploadbutton@0.8.17

@gradio/uploadbutton@0.8.18

@gradio/uploadbutton@0.9.0

@gradio/video@0.*

@gradio/video@0.14.11

@gradio/video@0.14.12

@gradio/video@0.14.13

@gradio/video@0.14.14

@self/app@1.*

@self/app@1.49.3

@self/app@1.49.4

@self/app@1.49.5

@self/app@1.49.6

@self/app@1.49.7

@self/app@1.49.8

@self/component-test@0.*

@self/component-test@0.5.17

@self/component-test@0.5.18

@self/component-test@0.5.19

@self/component-test@0.5.20

@self/storybook@0.*

@self/storybook@0.8.2

@self/tootils@0.*

@self/tootils@0.7.21

@self/tootils@0.7.22

gradio@5.*

gradio@5.25.2

gradio@5.26.0

gradio@5.27.0

gradio@5.27.1

gradio@5.28.0

gradio@5.29.0

gradio@5.29.1

gradio@5.30.0

gradio_client@1.*

gradio_client@1.10.0

gradio_client@1.10.1

gradio_client@1.9.0

gradio_client@1.9.1

website@0.*

website@0.55.0

website@0.56.0

website@0.56.1

website@0.56.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48889.json"