africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2024-8966 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2024-8966 Source advisory: OSV:PYSEC-2026-1410...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2026-49119 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2026-49119 Source advisory: OSV:GHSA-J36P-7W88-G82J...

iopaint (>=1.0.0b11, <=1.2.2), lisa-on-cuda (>=1.4.2, <=1.4.8) +4 more potentially affected by CVE-2026-49119 via gradio (5.1.0)

gradio PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - iopaint =1.0.0b11, =1.4.2, =0.2.0, =0.1.6, =0.15.0, =0.16.0 Source cves: CVE-2026-49119 Source advisory: OSV:GHSA-J36P-7W88-G82J...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2026-49119 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2026-49119 Source advisory: OSV:PYSEC-2026-2179...

iopaint (>=1.0.0b11, <=1.2.2), lisa-on-cuda (>=1.4.2, <=1.4.8) +4 more potentially affected by CVE-2026-49119 via gradio (5.1.0)

gradio PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - iopaint =1.0.0b11, =1.4.2, =0.2.0, =0.1.6, =0.15.0, =0.16.0 Source cves: CVE-2026-49119 Source advisory: OSV:PYSEC-2026-2179...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2026-10783 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2026-10783 Source advisory: OSV:GHSA-6655-8PH2-63J3...

iopaint (>=1.0.0b11, <=1.2.2), lisa-on-cuda (>=1.4.2, <=1.4.8) +4 more potentially affected by CVE-2026-10783 via gradio (5.1.0)

gradio PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - iopaint =1.0.0b11, =1.4.2, =0.2.0, =0.1.6, =0.15.0, =0.16.0 Source cves: CVE-2026-10783 Source advisory: OSV:GHSA-6655-8PH2-63J3...

iopaint (>=1.0.0b11, <=1.2.2), lisa-on-cuda (>=1.4.2, <=1.4.8) +4 more potentially affected by CVE-2026-10783 via gradio (5.1.0)

gradio PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - iopaint =1.0.0b11, =1.4.2, =0.2.0, =0.1.6, =0.15.0, =0.16.0 Source cves: CVE-2026-10783 Source advisory: OSV:PYSEC-2026-211...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2026-48545 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2026-48545 Source advisory: OSV:GHSA-7HP7-4P35-3CX2...

iopaint (>=1.0.0b11, <=1.2.2), lisa-on-cuda (>=1.4.2, <=1.4.8) +4 more potentially affected by CVE-2026-48545 via gradio (5.1.0)

gradio PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - iopaint =1.0.0b11, =1.4.2, =0.2.0, =0.1.6, =0.15.0, =0.16.0 Source cves: CVE-2026-48545 Source advisory: OSV:PYSEC-2026-2178...

africanwhisper (>=0.2.1, <=0.2.5), iopaint (>=1.2.3, <=1.6.0) +3 more potentially affected by CVE-2026-48545 via gradio (4.21.0)

gradio PYPI version 4.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - africanwhisper =0.2.1, =1.2.3, =1.0.4.post1, =0.2.2, =1.2.3 - llmtuner 0.6.2 Source cves: CVE-2026-48545 Source advisory: OSV:PYSEC-2026-2178...

CVE-2026-5258

A vulnerability was found in Sanster IOPaint 1.5.3. Impacted is the function getfile of the file iopaint/filemanager/filemanager.py of the component File Manager. Performing a manipulation of the argument filename results in path traversal. The attack is possible to be carried out remotely. The...

EUVD-2026-17821

A vulnerability was found in Sanster IOPaint 1.5.3. Impacted is the function getfile of the file iopaint/filemanager/filemanager.py of the component File Manager. Performing a manipulation of the argument filename results in path traversal. The attack is possible to be carried out remotely. The...

CVE-2026-5258

A vulnerability was found in Sanster IOPaint 1.5.3. Impacted is the function getfile of the file iopaint/filemanager/filemanager.py of the component File Manager. Performing a manipulation of the argument filename results in path traversal. The attack is possible to be carried out remotely. The...

CVE-2026-5258

A vulnerability was found in Sanster IOPaint 1.5.3. Impacted is the function getfile of the file iopaint/filemanager/filemanager.py of the component File Manager. Performing a manipulation of the argument filename results in path traversal. The attack is possible to be carried out remotely. The...

CVE-2026-5258 Sanster IOPaint File Manager file_manager.py _get_file path traversal

A vulnerability was found in Sanster IOPaint 1.5.3. Impacted is the function getfile of the file iopaint/filemanager/filemanager.py of the component File Manager. Performing a manipulation of the argument filename results in path traversal. The attack is possible to be carried out remotely. The...

CVE-2026-5258

The CVE concerns Sanster IOPaint 1.5.3. The vulnerable component is the File Manager’s _get_file function in iopaint/file_manager/file_manager.py. Affected behavior is path traversal caused by manipulating the filename argument. The issue allows remote exploitation, and public exploit materials e...

CVE-2026-5258 Sanster IOPaint File Manager file_manager.py _get_file path traversal

A vulnerability was found in Sanster IOPaint 1.5.3. Impacted is the function getfile of the file iopaint/filemanager/filemanager.py of the component File Manager. Performing a manipulation of the argument filename results in path traversal. The attack is possible to be carried out remotely. The...

PT-2026-29477

A vulnerability was found in Sanster IOPaint 1.5.3. Impacted is the function get file of the file iopaint/file manager/file manager.py of the component File Manager. Performing a manipulation of the argument filename results in path traversal. The attack is possible to be carried out remotely. Th...

IOPaint path traversal vulnerability

IOPaint is an AI-based image restoration and content generation tool developed by Qing. Version 1.5.3 of IOPaint contains a path traversal vulnerability, which stems from incorrect handling of the parameter filename in the file iopaint/filemanager/filemanager.py. This vulnerability may lead to pa...