{"id":"CVE-2025-48889","summary":"Gradio Allows Unauthorized File Copy via Path Manipulation","details":"Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Prior to version 5.31.0, an arbitrary file copy vulnerability in Gradio's flagging feature allows unauthenticated attackers to copy any readable file from the server's filesystem. While attackers can't read these copied files, they can cause DoS by copying large files (like /dev/urandom) to fill disk space. This issue has been patched in version 5.31.0.","aliases":["GHSA-8jw3-6x8j-v96g","PYSEC-2025-119"],"modified":"2026-08-12T03:51:20.655535688Z","published":"2025-05-30T06:12:32.703Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-434"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48889.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48889.json"},{"type":"ADVISORY","url":"https://github.com/gradio-app/gradio/security/advisories/GHSA-8jw3-6x8j-v96g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48889"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gradio-app/gradio","events":[{"introduced":"73188fb5ddb934fff10339f3c08fcbed291f2133"},{"fixed":"16c9b246f714c03a2ece8f96515f55636700dc27"}],"database_specific":{"source":["AFFECTED_FIELD","CPE_RANGE"],"cpe":"cpe:2.3:a:gradio_project:gradio:*:*:*:*:*:python:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.31.0"},{"introduced":"5.25.2"}]}}],"versions":["website@0.56.2","gradio@5.30.0","@self/tootils@0.7.22","@self/component-test@0.5.20","@self/app@1.49.8","@gradio/video@0.14.14","@gradio/uploadbutton@0.9.0","@gradio/upload@0.16.5","@gradio/textbox@0.10.11","@gradio/statustracker@0.10.11","@gradio/slider@0.6.9","@gradio/sketchbox@0.6.8","@gradio/simpletextbox@0.3.21","@gradio/simpleimage@0.8.29","@gradio/simpledropdown@0.3.21","@gradio/sidebar@0.1.13","@gradio/radio@0.7.4","@gradio/plot@0.9.16","@gradio/paramviewer@0.7.9","@gradio/number@0.5.21","@gradio/nativeplot@0.5.16","@gradio/multimodaltextbox@0.10.6","@gradio/model3d@0.14.13","@gradio/markdown@0.13.12","@gradio/lite@5.30.0","@gradio/label@0.5.13","@gradio/json@0.5.22","@gradio/imageslider@0.2.2","@gradio/imageeditor@0.15.0","@gradio/image@0.22.6","@gradio/html@0.6.13","@gradio/highlightedtext@0.9.4","@gradio/gallery@0.15.19","@gradio/form@0.2.19","@gradio/fileexplorer@0.5.29","@gradio/file@0.12.18","@gradio/fallback@0.4.21","@gradio/dropdown@0.9.21","@gradio/downloadbutton@0.4.0","@gradio/datetime@0.3.13","@gradio/dataset@0.4.19","@gradio/dataframe@0.17.12","@gradio/core@0.17.0","@gradio/colorpicker@0.4.21","@gradio/code@0.14.4","@gradio/client@1.15.0","@gradio/checkboxgroup@0.6.21","@gradio/checkbox@0.4.21","@gradio/chatbot@0.26.7","@gradio/button@0.5.0","@gradio/box@0.2.19","@gradio/audio@0.17.14","@gradio/atoms@0.16.1","@gradio/annotatedimage@0.9.19","@gradio/accordion@0.5.15","website@0.56.1","gradio_client@1.10.1","gradio@5.29.1","@gradio/tabs@0.4.4","@gradio/tabitem@0.4.4","@gradio/nativeplot@0.5.15","@gradio/json@0.5.21","@gradio/dataset@0.4.18","@gradio/chatbot@0.26.6","website@0.56.0","gradio@5.29.0","@self/component-test@0.5.19","@self/app@1.49.7","@gradio/video@0.14.13","@gradio/uploadbutton@0.8.18","@gradio/upload@0.16.4","@gradio/simpleimage@0.8.28","@gradio/multimodaltextbox@0.10.5","@gradio/model3d@0.14.12","@gradio/markdown@0.13.11","@gradio/lite@5.29.0","@gradio/imageslider@0.2.1","@gradio/imageeditor@0.14.5","@gradio/image@0.22.5","@gradio/html@0.6.12","@gradio/gallery@0.15.18","@gradio/fileexplorer@0.5.28","@gradio/file@0.12.17","@gradio/downloadbutton@0.3.18","@gradio/dataset@0.4.17","@gradio/dataframe@0.17.11","@gradio/core@0.16.1","@gradio/code@0.14.3","@gradio/chatbot@0.26.5","@gradio/button@0.4.18","@gradio/audio@0.17.13","@gradio/annotatedimage@0.9.18","gradio_client@1.10.0","gradio@5.28.0","@self/app@1.49.6","@gradio/lite@5.28.0","@gradio/core@0.16.0","@gradio/chatbot@0.26.4","gradio_client@1.9.1","gradio@5.27.1","@self/component-test@0.5.18","@self/app@1.49.5","@gradio/video@0.14.12","@gradio/uploadbutton@0.8.17","@gradio/multimodaltextbox@0.10.4","@gradio/lite@5.27.1","@gradio/imageeditor@0.14.4","@gradio/image@0.22.4","@gradio/gallery@0.15.17","@gradio/downloadbutton@0.3.17","@gradio/dataframe@0.17.10","@gradio/core@0.15.1","@gradio/chatbot@0.26.3","@gradio/button@0.4.17","@gradio/audio@0.17.12","website@0.55.0","gradio@5.27.0","@self/tootils@0.7.21","@self/storybook@0.8.2","@self/component-test@0.5.17","@self/app@1.49.4","@gradio/video@0.14.11","@gradio/uploadbutton@0.8.16","@gradio/upload@0.16.3","@gradio/textbox@0.10.10","@gradio/statustracker@0.10.10","@gradio/slider@0.6.8","@gradio/sketchbox@0.6.7","@gradio/simpletextbox@0.3.20","@gradio/simpleimage@0.8.27","@gradio/simpledropdown@0.3.20","@gradio/sidebar@0.1.12","@gradio/radio@0.7.3","@gradio/plot@0.9.15","@gradio/paramviewer@0.7.8","@gradio/number@0.5.20","@gradio/nativeplot@0.5.14","@gradio/multimodaltextbox@0.10.3","@gradio/model3d@0.14.11","@gradio/markdown@0.13.10","@gradio/lite@5.27.0","@gradio/label@0.5.12","@gradio/json@0.5.20","@gradio/imageslider@0.2.0","@gradio/imageeditor@0.14.3","@gradio/image@0.22.3","@gradio/html@0.6.11","@gradio/highlightedtext@0.9.3","@gradio/gallery@0.15.16","@gradio/form@0.2.18","@gradio/fileexplorer@0.5.27","@gradio/file@0.12.16","@gradio/fallback@0.4.20","@gradio/dropdown@0.9.20","@gradio/downloadbutton@0.3.16","@gradio/datetime@0.3.12","@gradio/dataset@0.4.16","@gradio/dataframe@0.17.9","@gradio/core@0.15.0","@gradio/colorpicker@0.4.20","@gradio/code@0.14.2","@gradio/checkboxgroup@0.6.20","@gradio/checkbox@0.4.20","@gradio/chatbot@0.26.2","@gradio/button@0.4.16","@gradio/box@0.2.18","@gradio/audio@0.17.11","@gradio/atoms@0.16.0","@gradio/annotatedimage@0.9.17","@gradio/accordion@0.5.14","gradio_client@1.9.0","gradio@5.26.0","@self/app@1.49.3","@gradio/lite@5.26.0","@gradio/imageeditor@0.14.2","@gradio/dataframe@0.17.8","@gradio/core@0.14.1","gradio@5.25.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48889.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}