# CVE-2024-51751: Arbitrary file read with File and UploadButton components in Gradio

- Exploited (CISA KEV): no
- Published: 2024-11-06
- CVSS: 6.5 MEDIUM (v3.1)
- EPSS: 0.7% (52th percentile)
- CWE: CWE-22

Gradio is an open-source Python package designed to enable quick builds of a demo or web application. If File or UploadButton components are used as a part of Gradio application to preview file content, an attacker with access to the application might abuse these components to read arbitrary files from the application server. This issue has been addressed in release version 5.5.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-01-21 | 76 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2025-01-21 · new · rule 200014046
  > Added: signature 200014046 "Gradio File Component Arbitrary File Read" (Abuse of Functionality, risk High), systems: Python. References: CVE-2024-51751.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2025-03-11 · new · rule 200014046
  > Added: signature 200014046 "Gradio File Component Arbitrary File Read" (Abuse of Functionality, risk High), systems: Python. References: CVE-2024-51751.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2024-51751 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2024-51751