Gradio CVE-2026-49119

Exploitation requires the target Gradio application (version before 6.16.0) to instantiate and expose the FileExplorer component, whose preprocess() method processes the attacker-controlled path; this is the exact feature that must be present. Given AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special network position is needed once a FileExplorer endpoint is reachable - the attacker simply supplies path segments containing '../' traversal sequences or an absolute path. The primary limiting factor is deployment-specific: apps that do not use FileExplorer are not exploitable, and impact is confined to reading files the Gradio process account can access (VC:H, but VI:N/VA:N - no write or code execution).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N, base 8.7) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact and no integrity or availability impact - consistent with an arbitrary file read. This is a genuine, easily exploitable disclosure bug wherever a FileExplorer is exposed, though real-world impact is bounded to information disclosure only (no code execution or write). No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active exploitation; the signal is a credible advisory from VulnCheck plus a vendor patch. The main caveat limiting practical risk is that exploitation requires the affected app to actually instantiate and expose the FileExplorer component - not every Gradio deployment does. Net: a real, high-priority disclosure issue for exposed FileExplorer apps, but not a mass-exploitation event based on available data.

An attacker who can reach a public Gradio app that exposes a FileExplorer submits a crafted path such as an absolute path (e.g. '/etc/passwd') or a segment containing '../' sequences to the component's preprocess() handler. Because os.path.join drops the root_dir prefix, the server returns files outside the intended directory, letting the attacker read source code, configuration, or credential files. No authentication or user interaction is required (AV:N/PR:N/UI:N), and no public exploit has been identified yet.