CVE-2026-49119: Gradio Path Traversal Vulnerability – HIGH Risk File Access Flaw

Technical summary

CVE-2026-49119 is a path traversal vulnerability (CWE-22) in the FileExplorer component's preprocess() method in Gradio versions prior to 6.16.0. The vulnerability stems from improper handling of user-supplied path segments in os.path.join operations. When an attacker provides crafted paths containing directory traversal sequences (e.g., '../') or absolute paths, the root_dir prefix is discarded entirely, allowing arbitrary file access. The flaw requires no authentication and can be exploited over the network, making it a straightforward attack vector.

Business impact

Organizations deploying Gradio to serve machine learning models or data interfaces face confidentiality risk. Attackers can extract sensitive training data, API keys, configuration files, or other secrets stored on the same system. This is particularly concerning in research and data science environments where proprietary datasets or model weights may be exposed. The vulnerability does not enable file modification or denial of service, but the confidentiality breach alone can result in intellectual property loss and regulatory compliance violations if personal data is exposed.

Affected systems

All Gradio installations before version 6.16.0 are affected. This includes both direct deployments and applications that bundle Gradio as a dependency. The vulnerability affects all deployment contexts—cloud, on-premises, or containerized—as long as the vulnerable version is in use. No authentication or special privileges are required by an attacker.

Exploitability

Exploitation is straightforward and requires only network access. No authentication is needed, and no user interaction is required. An attacker can craft HTTP requests with malicious path parameters to trigger the vulnerability. The attack surface is wide: any deployment exposing the FileExplorer component is vulnerable. The CVSS 3.1 score of 7.5 (HIGH) reflects the combination of network accessibility, low attack complexity, and high confidentiality impact. However, the vulnerability is not currently in the CISA KEV catalog, suggesting active exploitation has not been widely observed in the wild at the time of analysis.

Remediation

Upgrade Gradio to version 6.16.0 or later immediately. This version includes a fix for the path traversal vulnerability. Verify the patch version against the official Gradio release notes or PyPI repository. If immediate patching is not feasible, consider disabling or restricting access to FileExplorer components until patching is complete. Network-level controls (e.g., IP whitelisting, authentication proxies) can reduce attack surface but do not eliminate the vulnerability.

Patch guidance

Update Gradio using your package manager: pip install --upgrade gradio>=6.16.0. Verify the installed version with pip show gradio to confirm the patch is in place. For production environments, test the upgrade in a non-production environment first to ensure compatibility with your application. Check the Gradio GitHub repository and official release notes for any breaking changes or migration guidance between your current version and 6.16.0.

Detection guidance

Monitor for suspicious file access patterns in application logs and file system audits, particularly requests to the FileExplorer endpoint with path segments containing '../' or absolute paths (e.g., '/etc/', 'C:\Windows\'). Web application firewalls (WAF) can be configured to block requests with directory traversal patterns in URL parameters. Endpoint detection and response (EDR) tools should flag unexpected file reads from the Gradio process outside the configured root directory. Review access logs for the FileExplorer component retroactively to identify potential exploitation attempts.

Why prioritize this

This vulnerability merits immediate patching due to the combination of high CVSS score (7.5), unauthenticated network exploitability, and confidentiality impact. Organizations using Gradio in production should prioritize this update within their standard security patching cycle. The lack of KEV status suggests lower current threat from active exploitation, but the vulnerability is trivial to exploit once discovered.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects: (1) Network-accessible attack vector (AV:N), (2) Low attack complexity requiring no special conditions (AC:L), (3) No authentication required (PR:N), (4) No user interaction needed (UI:N), (5) Confidentiality impact rated as high (C:H), and (6) No integrity or availability impact (I:N, A:N). The score places this in the HIGH severity band—actionable within standard remediation windows but not critical.

Frequently asked questions