AVID-2026-R1659

Description

Gradio Blocked Path ACL Bypass Vulnerability (CVE-2025-23042)

Details

Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio’s Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windows and macOS, this flaw enables attackers to circumvent security restrictions and access sensitive files that should be protected. This issue can lead to unauthorized data access, exposing sensitive information and undermining the integrity of Gradio’s security model. Given Gradio’s popularity for building web applications, particularly in machine learning and AI, this vulnerability may pose a substantial threat if exploited in production environments. This issue has been addressed in release version 5.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Reason for inclusion in AVID: The CVE concerns a vulnerability in Gradio, a Python package widely used to build AI demos and ML web apps. It affects AI software stacks as a component (access control bypass in file paths within the Gradio interface), representing a software security vulnerability with potential data access impacts. This directly pertains to software components used to build/run general-purpose AI systems, i.e., the AI software supply chain. The report provides explicit CVE details and a fix release, satisfying sufficiency criteria.

References

• NVD entry
• https://github.com/gradio-app/gradio/security/advisories/GHSA-j2jg-fq62-7c3h

Affected or Relevant Artifacts

• Developer: gradio-app
• Deployer: gradio-app
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2025-01-14
• Version: 0.3.3
• AVID Entry