CVE-2026-49119
Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()
CVSS Score
7.5
EPSS Score
0.7%
EPSS Percentile
49th
Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured root directory by supplying path segments containing directory traversal sequences or absolute paths. Attackers can provide crafted path segments that cause os.path.join to discard the root_dir prefix entirely, resulting in arbitrary file read or exposure of sensitive files outside the intended directory.
| CWE | CWE-22 |
| Vendor | gradio-app |
| Product | gradio |
| Published | Jul 1, 2026 |
| Last Updated | Jul 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for gradio-app gradio
Be the first to know when new high vulnerabilities affecting gradio-app gradio are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
gradio-app / gradio
0 < 6.16.0
References
github.com: https://github.com/gradio-app/gradio/releases/tag/gradio%406.16.0 github.com: https://github.com/gradio-app/gradio/pull/13437 github.com: https://github.com/gradio-app/gradio/commit/97d541f3d5fd05b2587a69ecc94b68fe5d2d7004 vulncheck.com: https://www.vulncheck.com/advisories/gradio-path-traversal-via-fileexplorer-preprocess