CVE-2024-1727 CSRF Vulnerability in gradio-app/gradio

What is CVE-2024-1727?

CVE-2024-1727 is a medium-severity vulnerability in Gradio Project Gradio, published on 21 Mar 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the victim's server, an attacker can deplete the system's disk space, potentially leading to a denial of service. This issue affects the file upload functionality as implemented in gradio/routes.py.

Weakness: CWE-352

Which versions are affected by CVE-2024-1727?

3 open source packages ship an affected version, including gradio. It affects 1 product.

Products include Gradio Project Gradio.

How do I fix CVE-2024-1727?

Upgrade gradio to 4.19.2 or later.

Is CVE-2024-1727 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-1727 exists.

Other vulnerabilities in Gradio Project Gradio

• CVE-2024-39236 Withdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py Critical 9.8
• CVE-2023-6572 Command Injection in gradio-app/gradio Critical 9.6
• CVE-2022-24770 Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging High 8.8
• CVE-2026-49119 Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess() High 8.7
• CVE-2025-23042 Gradio Blocked Path ACL Bypass Vulnerability High 8.7

All Gradio Project Gradio vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-48cq-79qq-6f7x, PYSEC-2026-1409.