Gradio - Absolute Path Traversal

Gradio 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server. id: CVE-2026-28414 info: name: Gradio - Absolute Path Traversal author: 0xAkoko severity:...

VulnCheck KEV: CVE-2026-28414

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. Python 3.13+ change...

CVE-2026-28414

creationtimestamp| type| source ---|---|--- 2026-02-27 20:22:53+00:00| published-proof-of-concept| https://github.com/gradio-app/gradio/security/advisories/GHSA-39mp-8hj3-5c49 2026-02-28 00:28:18+00:00| published-proof-of-concept| https://t.me/realcodeb0ss/348 2026-02-28 05:01:30+00:00| seen|...