SecBoard
Zurück zur CVE-Übersicht

CVE-2026-59806

HIGH(7.4)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Risk Signal Score29/100 — MITTEL
  • CVSS 7.4 — Hoch
  • Weniger als 24 Stunden alt

Beschreibung

Gradio before 6.20.0 contains an open redirect and server-side request forgery vulnerability that allows attackers to redirect users to arbitrary URLs or perform client-side SSRF by supplying unvalidated HTTP/HTTPS URLs to the file_fetch() function in the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response targeting internal endpoints such as cloud metadata services to retrieve sensitive credentials including EC2 IAM role credentials.

Referenzen