Which versions of Gradio are affected by CVE-2026-49119?

Gradio before version 6.16.0 contains a vulnerability enabling unauthenticated attackers to access and extract arbitrary files from affected systems, including source code, API credentials, and other…. A patch is available.

How to fix or mitigate CVE-2026-49119?

Within 24 hours: Audit all Gradio deployments to identify which expose the FileExplorer component and assess what sensitive files are accessible. Within 7 days: Upgrade all affected Gradio instances to version 6.16.0 or later. Within 30 days: Review application logs and file access records for indicators of unauthorized file reads or exfiltration attempts.

Gradio CVE-2026-49119

Q: What is the CVSS score of CVE-2026-49119?

CVE-2026-49119 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

EUVD-2026-41115 HIGH

Path Traversal (CWE-22)

2026-07-01 VulnCheck

GHSA-j36p-7w88-g82j

Path Traversal Gradio

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated, low-complexity path traversal yielding arbitrary file read; PR:N and UI:N per the flaw, C:H with I:N/A:N since impact is disclosure only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 19:33 vuln.today

DescriptionCVE.org

Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured root directory by supplying path segments containing directory traversal sequences or absolute paths. Attackers can provide crafted path segments that cause os.path.join to discard the root_dir prefix entirely, resulting in arbitrary file read or exposure of sensitive files outside the intended directory.

AnalysisAI

Arbitrary file read in Gradio before 6.16.0 lets remote unauthenticated attackers escape the FileExplorer component's configured root_dir by submitting path segments with traversal sequences ('../') or absolute paths, exploiting how os.path.join discards the root prefix when handed an absolute path. Any Gradio app exposing a FileExplorer is exposed, enabling exposure of sensitive files (source code, secrets, credentials) outside the intended directory. There is no public exploit identified at time of analysis, but the flaw was reported by VulnCheck and a vendor patch is available.

Technical ContextAI

Gradio is a widely used Python framework for building web UIs and demos for machine-learning models. The FileExplorer component is designed to let users browse a restricted directory tree rooted at a configured root_dir. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the preprocess() method joins attacker-supplied path segments to root_dir using os.path.join, which in Python silently discards all preceding components when any later argument is an absolute path (e.g. os.path.join('/root_dir', '/etc/passwd') returns '/etc/passwd'). Combined with unsanitized '../' sequences, this defeats the intended sandbox. The CPE cpe:2.3:a:gradio-app:gradio:*:*:*:*:*:*:*:* confirms all versions prior to the fix are affected.

RemediationAI

Vendor-released patch: upgrade Gradio to 6.16.0 or later (https://github.com/gradio-app/gradio/releases/tag/gradio%406.16.0), which corrects the preprocess() path handling per PR #13437 and commit 97d541f. If immediate upgrade is not possible, remove or disable exposed FileExplorer components in your Gradio apps, or place the application behind authentication and network restrictions so untrusted users cannot reach the file-browsing endpoint - the trade-off being loss of the file-browsing feature or broader access for legitimate users. As a defense-in-depth measure, run the Gradio process under a low-privilege account with filesystem access limited (e.g. via container mounts or chroot) to only the directory the FileExplorer is meant to serve, limiting what an escape can read. Review VulnCheck's advisory at https://www.vulncheck.com/advisories/gradio-path-traversal-via-fileexplorer-preprocess for details.