VulnerabilityAnalyzed

CVE-2026-49119

HIGH 8.7EPSS 0.93%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.93%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured root directory by supplying path segments containing directory traversal sequences or absolute paths. Attackers can provide crafted path segments that cause os.path.join to discard the root_dir prefix entirely, resulting in arbitrary file read or exposure of sensitive files outside the intended directory.

CVSS 4.0: 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.93% probability · 59th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: gradio project/gradio
Source: disclosure@vulncheck.com

References

https://github.com/gradio-app/gradio/commit/97d541f3d5fd05b2587a69ecc94b68fe5d2d7004Patch
https://github.com/gradio-app/gradio/pull/13437Issue Tracking, Patch
https://github.com/gradio-app/gradio/releases/tag/gradio%406.16.0Product, Release Notes
https://www.vulncheck.com/advisories/gradio-path-traversal-via-fileexplorer-preprocessPatch, Release Notes, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.