PT-2026-54771 · Gradio · Gradio

Abidlabs · Published 2026-07-01 · Updated 2026-07-02 · CVE-2026-49119

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 6.16.0

Description A path traversal issue exists in the preprocess() function of the FileExplorer component. Unauthenticated attackers can escape the configured root directory by providing path segments that include absolute paths or directory traversal sequences. This occurs because the os.path.join function may discard the root dir prefix when processing these crafted segments, leading to arbitrary file read or the exposure of sensitive files located outside the intended directory.

Recommendations Update Gradio to version 6.16.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-49119

Affected Products

Gradio

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49119.json · Exploit
• https://github.com/gradio-app/gradio/pull/13437 · Patch
• https://github.com/gradio-app/gradio/commit/97d541f3d5fd05b2587a69ecc94b68fe5d2d7004 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49119 · Security Note
• https://vulncheck.com/advisories/gradio-path-traversal-via-fileexplorer-preprocess · Patch
• https://osv.dev/vulnerability/CVE-2026-49119 · Vendor Advisory
• https://github.com/gradio-app/gradio/releases/tag/gradio%406.16.0 · Note
• https://github.com/gradio-app/gradio · Note
• https://t.me/CVEtracker/58608 · Telegram Post
• https://t.me/cveNotify/184984 · Telegram Post