-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability explicitly references the /upload interface as the attack vector. In web frameworks like Gradio, route handlers are typically mapped to specific functions. The combination of CWE-434 (unrestricted file upload) and the advisory's description of temporary directory uploads points to the file upload handler function as the vulnerable component. While exact code isn't available, Gradio's architecture patterns and the vulnerability description strongly suggest the upload_file route handler in routes.py is responsible for insecure file handling.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gradio | pip | <= 3.27.0 |
PythonPythonOngoing coverage of React2Shell