What’s Vulnerable › Vulnerabilities

CVE-2026-49119: Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-01 · updated 2026-10-25
• Weakness: CWE-22

Description

Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured root directory by supplying path segments containing directory traversal sequences or absolute paths. Attackers can provide crafted path segments that cause os.path.join to discard the root_dir prefix entirely, resulting in arbitrary file read or exposure of sensitive files outside the intended directory.

Affected products

• gradio-app gradio: before 6.16.0 — fixed in 6.16.0

How to fix

Upgrade to a fixed version: gradio-app gradio 6.16.0. Check the vendor advisory for mitigations.

References

• https://github.com/gradio-app/gradio/commit/97d541f3d5fd05b2587a69ecc94b68fe5d2d7004
• https://github.com/gradio-app/gradio/pull/13437
• https://github.com/gradio-app/gradio/releases/tag/gradio%406.16.0
• https://www.vulncheck.com/advisories/gradio-path-traversal-via-fileexplorer-preprocess

Get alerted when CVE-2026-49119 or the next vulnerability affects your stack