Gradio - Absolute Path Traversal

Gradio 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server. id: CVE-2026-28414 info: name: Gradio - Absolute Path Traversal author: 0xAkoko severity:...

VulnCheck KEV: CVE-2026-28414

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. Python 3.13+ change...

matanyone2-runtime (>=0.1.0, <=0.2.0) potentially affected by CVE-2026-28414 via gradio (4.31.0)

gradio PYPI version 4.31.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - matanyone2-runtime =0.1.0, =0.2.0 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

lazyllm-llamafactory (0.9.3.dev0) potentially affected by CVE-2026-28414 via gradio (5.25.0)

gradio PYPI version 5.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - lazyllm-llamafactory 0.9.3.dev0 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

draggan (>=1.0.4, <=1.1.5) potentially affected by CVE-2026-28414 via gradio (3.28.1)

gradio PYPI version 3.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - draggan =1.0.4, =1.1.5 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

whisply (>=0.10.0, <=0.10.3) potentially affected by CVE-2026-28414 via gradio (5.23.0)

gradio PYPI version 5.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - whisply =0.10.0, =0.10.3 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

ksaa (>=2025.3.15.0, <=2025.11.0b3), llamafactory (0.9.2) potentially affected by CVE-2026-28414 via gradio (5.21.0)

gradio PYPI version 5.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - ksaa =2025.3.15.0, =2025.11.0b3 - llamafactory 0.9.2 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

openvino-openai-api (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-28414 via gradio (5.20.0)

gradio PYPI version 5.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - openvino-openai-api =0.1.0, =0.1.1 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

optillm (>=0.1.7, <=0.1.11) potentially affected by CVE-2026-28414 via gradio (5.15.0)

gradio PYPI version 5.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - optillm =0.1.7, =0.1.11 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

mergenetic (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-28414 via gradio (5.29.1)

gradio PYPI version 5.29.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - mergenetic =0.1.0, =0.1.1 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

fastvideo (>=0.1.7, <=0.2.1) potentially affected by CVE-2026-28414 via gradio (5.32.0)

gradio PYPI version 5.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - fastvideo =0.1.7, =0.2.1 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-28414 via gradio (5.49.1)

gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

cleanunet-denoiser (>=0.0.1.dev1, <=0.0.1.dev3), depthflow (>=0.7.0.dev1, <=0.8.0) +4 more potentially affected by CVE-2026-28414 via gradio (4.44.0)

gradio PYPI version 4.44.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - cleanunet-denoiser =0.0.1.dev1, =0.7.0.dev1, =0.4.5, =0.5.9, =1.0.2, =1.0.8 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

rexia-ai (>=0.3.3, <=0.3.5.5) potentially affected by CVE-2026-28414 via gradio (4.39.0)

gradio PYPI version 4.39.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - rexia-ai =0.3.3, =0.3.5.5 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

autobiasdetector (0.0.2), chat-with-mlx (>=0.2.0, <=0.2.2) +6 more potentially affected by CVE-2026-28414 via gradio (4.29.0)

gradio PYPI version 4.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - autobiasdetector 0.0.2 - chat-with-mlx =0.2.0, =0.1.1, =0.0.1, =0.0.1, =1.3.0, =1.4.3 Source cves: CVE-2026-28414 Source advisory:...

lmdeploy (0.0.14) potentially affected by CVE-2026-28414 via gradio (4.0.0b15)

gradio PYPI version 4.0.0b15 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - lmdeploy 0.0.14 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

langs-vall (>=0.0.1, <=0.0.18) potentially affected by CVE-2026-28414 via gradio (3.47.1)

gradio PYPI version 3.47.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - langs-vall =0.0.1, =0.0.18 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

alignmap (1.0.0) potentially affected by CVE-2026-28414 via gradio (3.43.1)

gradio PYPI version 3.43.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - alignmap 1.0.0 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

artcraft (>=0.0.0, <=0.0.23), maestror (0.1.0) potentially affected by CVE-2026-28414 via gradio (3.41.2)

gradio PYPI version 3.41.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - artcraft =0.0.0, =0.0.23 - maestror 0.1.0 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

moviechat (0.1.0) potentially affected by CVE-2026-28414 via gradio (3.24.1)

gradio PYPI version 3.24.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - moviechat 0.1.0 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...