Gradio - Absolute Path Traversal

Gradio 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server. id: CVE-2026-28414 info: name: Gradio - Absolute Path Traversal author: 0xAkoko severity:...

VulnCheck KEV: CVE-2026-28414

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. Python 3.13+ change...

cleanunet-denoiser (>=0.0.1.dev1, <=0.0.1.dev3), depthflow (>=0.7.0.dev1, <=0.8.0) +4 more potentially affected by CVE-2026-28414 via gradio (4.44.0)

gradio PYPI version 4.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cleanunet-denoiser =0.0.1.dev1, =0.7.0.dev1, =0.4.5, =0.5.9, =1.0.2, =1.0.8 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

allmetal3d (>=0.4.0, <=0.7.3) potentially affected by CVE-2026-28414 via gradio (4.20.0)

gradio PYPI version 4.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - allmetal3d =0.4.0, =0.7.3 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

gradio-rerun (0.26.0a1), particleanalyzer (>=1.3.2, <=1.3.3) potentially affected by CVE-2026-28414 via gradio (5.47.2)

gradio PYPI version 5.47.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gradio-rerun 0.26.0a1 - particleanalyzer =1.3.2, =1.3.3 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

ai-agents (>=0.0.2, <=0.0.3), autotrain-advanced (>=0.6.15, <=0.6.31) potentially affected by CVE-2026-28414 via gradio (3.39.0)

gradio PYPI version 3.39.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - ai-agents =0.0.2, =0.6.15, =0.6.31 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

explainitall (>=1.0.0, <=1.0.2) potentially affected by CVE-2026-28414 via gradio (4.4.1)

gradio PYPI version 4.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - explainitall =1.0.0, =1.0.2 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

eevee-chat (>=0.0.1, <=0.0.3) potentially affected by CVE-2026-28414 via gradio (4.23.0)

gradio PYPI version 4.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - eevee-chat =0.0.1, =0.0.3 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

openvino-openai-api (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-28414 via gradio (5.20.0)

gradio PYPI version 5.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - openvino-openai-api =0.1.0, =0.1.1 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

go-chatgpt (0.0.3), video-transformers (>=0.0.7, <=0.0.9) potentially affected by CVE-2026-28414 via gradio (3.20.1)

gradio PYPI version 3.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - go-chatgpt 0.0.3 - video-transformers =0.0.7, =0.0.9 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

orca-sdk (>=0.0.78, <=0.1.1) potentially affected by CVE-2026-28414 via gradio (5.13.0)

gradio PYPI version 5.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - orca-sdk =0.0.78, =0.1.1 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

fastvideo (>=0.1.7, <=0.2.1) potentially affected by CVE-2026-28414 via gradio (5.32.0)

gradio PYPI version 5.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - fastvideo =0.1.7, =0.2.1 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

xinference (>=0.10.1, <=0.14.4.post1) potentially affected by CVE-2026-28414 via gradio (4.26.0)

gradio PYPI version 4.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - xinference =0.10.1, =0.14.4.post1 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

gcvit (>=1.0.4, <=1.0.9) potentially affected by CVE-2026-28414 via gradio (3.1.0)

gradio PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - gcvit =1.0.4, =1.0.9 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

infervcpy (>=0.1.0, <=1.6.0), lisa-on-cuda (1.4.1) +3 more potentially affected by CVE-2026-28414 via gradio (4.40.0)

gradio PYPI version 4.40.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - infervcpy =0.1.0, =0.0.12, =1.0.0a30, =1.0.0, =1.0.1 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-28414 via gradio (5.49.1)

gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

artcraft (>=0.0.0, <=0.0.16), maestror (0.1.0) potentially affected by CVE-2026-28414 via gradio (3.41.2)

gradio PYPI version 3.41.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - artcraft =0.0.0, =0.0.16 - maestror 0.1.0 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

langs-vall (>=0.0.1, <=0.0.18) potentially affected by CVE-2026-28414 via gradio (3.47.1)

gradio PYPI version 3.47.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - langs-vall =0.0.1, =0.0.18 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

rexia-ai (>=0.3.3, <=0.3.5.5) potentially affected by CVE-2026-28414 via gradio (4.39.0)

gradio PYPI version 4.39.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - rexia-ai =0.3.3, =0.3.5.5 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

mergenetic (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-28414 via gradio (5.29.1)

gradio PYPI version 5.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - mergenetic =0.1.0, =0.1.1 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...