{
 "id": "AIR-2025-0293",
 "slug": "cve-2025-48889-gradio-arbitrary-file-copy-vulnerability",
 "title": "CVE-2025-48889: Gradio Arbitrary File Copy Vulnerability",
 "summary": "An arbitrary file copy vulnerability in Gradio allows unauthenticated attackers to read or copy files from the server's filesystem. The flaw can be triggered via crafted API requests to cause denial of service by filling disk space.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Gradio"
 ],
 "incident_date": "2025-05-29",
 "incident_date_precision": "day",
 "first_reported": "2025-05-29",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-8jw3-6x8j-v96g",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2025-48889: Gradio Allows Unauthorized File Copy via Path Manipulation",
   "published_at": "2025-05-29"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48889",
   "publisher": "NVD",
   "title": "CVE-2025-48889: Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API,…",
   "published_at": "2025-05-30"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2025-48889",
  "gradio",
  "path-manipulation"
 ],
 "created_at": "2026-10-18T07:00:14.101Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}