CVE-2024-1728 is a high severity (CVSS 7.5) local file inclusion flaw in gradio-app/gradio. Improper validation of file paths in the UploadButton component lets attackers read arbitrary files on the filesystem, such as private SSH keys, through the queue join endpoint. Upgrade to a release that includes the fix commit.
What's affected
The record describes gradio-app/gradio as vulnerable because of improper validation of user supplied input in the UploadButton component, and says it could potentially lead to remote code execution. The references are a GitHub fix commit and a huntr bounty report. The record does not name the first fixed release, so confirm it in Gradio's release notes.
The NVD score is 7.5 (high) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The weakness is CWE-22 (path traversal).
How to check if you're exposed
Check the installed version.
pip show gradio
Compare it with the Gradio release notes for the fix commit 16fbe9cd0cffa9f2a824a0165beb43446114eec7. Also find out where Gradio apps are exposed. Demos shared through public links or hosted on open ports are reachable by anyone, and an app run as a user with access to keys or tokens exposes whatever that user can read.
What to do now
- Upgrade Gradio to a release that contains the fix commit.
- Do not expose Gradio apps to the public internet without authentication where you can avoid it.
- Run apps as a low privileged user in a container with no access to keys or credentials.
- Rotate any SSH keys or tokens on hosts where a vulnerable app was publicly reachable.
- Inventory Python environments to find forgotten Gradio demos.
Why it matters
Path handling bugs let a request name a file the application should never have opened. In this case the record says the upload path can be manipulated so the server reads a file from elsewhere on disk. File read flaws are serious in machine learning tooling because the host often holds API keys, model weights and cloud credentials.
The score is high rather than critical because the record describes read access rather than direct code execution. The KEV flag is false. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What can an attacker read?
The record gives private SSH keys as an example. Any file readable by the Gradio process may be exposed.
Sources
Last reviewed: 19 October 2026.
