CVE-2026-28414: Gradio Path Traversal Vulnerability

CVE-2026-28414 Overview

CVE-2026-28414 is a path traversal vulnerability in Gradio, an open-source Python package designed for quick prototyping of machine learning demos and web applications. This vulnerability affects Gradio installations running on Windows with Python 3.13 or later, enabling unauthenticated attackers to read arbitrary files from the file system through an absolute path traversal attack.

The vulnerability stems from a behavioral change in Python 3.13's os.path.isabs function, which no longer considers root-relative paths like /windows/win.ini as absolute paths on Windows systems. This change breaks Gradio's path validation logic, allowing attackers to bypass security controls and access sensitive files—even when the Gradio application has authentication enabled.

Critical Impact

Unauthenticated attackers can read arbitrary files from Gradio servers running on Windows with Python 3.13+, bypassing authentication controls and potentially exposing sensitive configuration files, credentials, and application data.

Affected Products

• Gradio versions prior to 6.7 running on Windows with Python 3.13+
• gradio_project gradio (all versions before 6.7)

Discovery Timeline

• 2026-02-27 - CVE CVE-2026-28414 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28414

Vulnerability Analysis

This vulnerability is classified under CWE-36 (Absolute Path Traversal) and CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The core issue lies in how Gradio handles path validation when joining user-supplied paths with server-side base directories.

Prior to Python 3.13, the os.path.isabs function on Windows would identify paths like /windows/win.ini as absolute paths (root-relative), allowing Gradio's path security logic to properly reject them. However, Python 3.13 changed this behavior to align with POSIX conventions, where such paths are considered relative rather than absolute on Windows.

The attack can be executed remotely over the network without any privileges or user interaction. Successful exploitation results in high confidentiality impact, as attackers can read arbitrary files from the target system. The vulnerability does not affect integrity or availability, making it a pure information disclosure issue.

Root Cause

The root cause is a compatibility issue between Gradio's path validation logic and Python 3.13's updated os.path.isabs semantics. Gradio relied on os.path.isabs to detect and reject absolute paths in user input, preventing directory traversal attacks. When Python 3.13 changed the definition of absolute paths on Windows, root-relative paths (starting with / but without a drive letter) were no longer detected as absolute, allowing them to slip through validation and be used in file access operations.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can craft malicious HTTP requests to a Gradio application, supplying root-relative paths like /windows/win.ini or /etc/passwd (on POSIX-like environments) as file references. Due to the flawed validation logic, these paths bypass security checks and are processed by the server, resulting in arbitrary file read access.

The vulnerability is particularly concerning because it bypasses Gradio's authentication mechanisms entirely. Even applications configured with authentication remain vulnerable, as the path traversal can be exploited before or around authentication checks in certain request handlers.

Attackers could target sensitive files such as Windows system configuration files, application configuration files containing database credentials, API keys stored in environment files, or source code of the deployed application.

Detection Methods for CVE-2026-28414

Indicators of Compromise

• Unexpected file access requests containing root-relative paths (e.g., /windows/system32/config/ or /windows/win.ini) in Gradio application logs
• HTTP requests with path traversal sequences targeting Gradio endpoints
• Access attempts to system configuration files or sensitive directories outside the application's intended scope
• Anomalous read operations on system files from the Gradio process

Detection Strategies

• Monitor HTTP request logs for path traversal patterns including root-relative paths starting with / followed by Windows system directories
• Implement Web Application Firewall (WAF) rules to detect and block requests containing suspicious path patterns
• Deploy file integrity monitoring on sensitive system files and directories
• Enable verbose logging in Gradio applications to capture all file access attempts

Monitoring Recommendations

• Configure centralized logging for all Gradio application instances with real-time alerting on suspicious file access patterns
• Establish baseline file access behavior for Gradio applications and alert on deviations
• Monitor process file descriptors for unexpected access to system files outside application directories
• Implement network-level monitoring for unusual data exfiltration patterns from Gradio servers

How to Mitigate CVE-2026-28414

Immediate Actions Required

• Upgrade Gradio to version 6.7 or later immediately on all Windows systems running Python 3.13+
• Audit existing Gradio deployments to identify vulnerable configurations (Windows + Python 3.13+)
• Review access logs for evidence of exploitation attempts
• Consider temporarily restricting network access to vulnerable Gradio instances until patching is complete

Patch Information

The vulnerability is fixed in Gradio version 6.7. Organizations should upgrade to this version or later to remediate the vulnerability. For detailed information about the fix, refer to the GitHub Security Advisory GHSA-39mp-8hj3-5c49.

To upgrade Gradio:

pip install --upgrade gradio>=6.7

Workarounds

• If immediate patching is not possible, consider downgrading Python to version 3.12 or earlier on affected Windows systems
• Deploy Gradio behind a reverse proxy with strict path filtering rules that reject root-relative paths
• Restrict network access to Gradio applications using firewall rules, limiting exposure to trusted networks only
• Run Gradio in containerized environments with restricted file system access to minimize the impact of potential exploitation

# Configuration example
# Upgrade Gradio to the patched version
pip install gradio==6.7

# Verify the installed version
pip show gradio | grep Version

# For containerized deployments, ensure minimal file system exposure
# Example Docker run with read-only root filesystem and limited volume mounts
docker run --read-only --tmpfs /tmp --volume /app/data:/data:ro gradio-app:latest