CVE-2026-49119: Gradio Path Traversal Vulnerability

CVE-2026-49119 Overview

CVE-2026-49119 is a path traversal vulnerability [CWE-22] in the Gradio machine learning application framework. Versions of Gradio prior to 6.16.0 contain a flaw in the FileExplorer component's preprocess() method. The method calls os.path.join with attacker-controlled path segments without validation. Unauthenticated network attackers can supply directory traversal sequences or absolute paths to escape the configured root_dir. Successful exploitation exposes arbitrary files outside the intended directory.

Critical Impact
Unauthenticated remote attackers can read arbitrary files on the host by submitting crafted path segments to a Gradio FileExplorer component, exposing source code, credentials, and other sensitive data.

Affected Products

Gradio versions prior to 6.16.0
Applications embedding the gr.FileExplorer component
Deployments exposing Gradio interfaces to untrusted networks

Discovery Timeline

2026-07-01 - CVE-2026-49119 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-49119

Vulnerability Analysis

Gradio is a Python framework for building web interfaces around machine learning models. The FileExplorer component lets users browse files under a developer-configured root_dir. The preprocess() method reconstructs a filesystem path from the client-supplied payload.root list by passing each segment into os.path.join.

Python's os.path.join has a documented behavior: when any argument is an absolute path, all previous components are discarded. Attackers exploit this by submitting a segment such as /etc/passwd or .. sequences. The root_dir prefix is silently dropped, and the resulting path resolves outside the intended directory. The server then reads and returns the target file to the client.

Root Cause

The root cause is unsafe use of os.path.join on untrusted input combined with the absence of a containment check confirming the resolved path stays within root_dir. Neither traversal sequences nor absolute path segments were filtered before joining.

Attack Vector

Exploitation requires only network access to a Gradio application exposing a FileExplorer component. No authentication or user interaction is needed. The attacker submits a crafted request containing traversal segments or an absolute path in the component's payload, then retrieves the arbitrary file contents from the response.

python

            elif len(payload.root) == 0:
                return None
            else:
-                return os.path.normpath(os.path.join(self.root_dir, *payload.root[0]))
+                return self._safe_join(payload.root[0])
        files = []
        for file in payload.root:
-            file_ = os.path.normpath(os.path.join(self.root_dir, *file))
+            file_ = self._safe_join(file)
            files.append(file_)
        return files

Source: Gradio commit 97d541f. The patch replaces the direct os.path.join call with a new _safe_join() helper that validates the resolved path remains within root_dir.

Detection Methods for CVE-2026-49119

Indicators of Compromise

HTTP requests to Gradio endpoints containing ../ sequences or URL-encoded variants (%2e%2e%2f) in FileExplorer payload fields.
Requests where payload.root list entries begin with a leading / or a Windows drive letter such as C:\.
Application logs showing FileExplorer reads of paths outside the configured root_dir, such as /etc/passwd, /proc/self/environ, or SSH key files.

Detection Strategies

Inspect reverse proxy and web application firewall logs for traversal patterns targeting Gradio component APIs.
Compare resolved file paths accessed by the Gradio process against the intended root_dir and alert on deviations.
Deploy runtime file integrity and access monitoring on hosts running Gradio to detect reads of sensitive system files by the Python process.

Monitoring Recommendations

Enable verbose request logging for Gradio applications, capturing the full JSON payload sent to FileExplorer components.
Alert on unauthenticated access to Gradio endpoints from external networks where authentication should have been enforced.
Track outbound data volume from Gradio hosts to identify bulk file exfiltration following successful traversal.

How to Mitigate CVE-2026-49119

Immediate Actions Required

Upgrade Gradio to version 6.16.0 or later on all affected hosts.
Inventory applications using gr.FileExplorer and prioritize internet-exposed deployments.
Restrict network access to Gradio interfaces using authentication, VPN, or IP allow-listing until patched.

Patch Information

The fix landed in Gradio 6.16.0 via pull request #13437 and commit 97d541f3. See the Gradio 6.16.0 release notes and the Vulncheck advisory for details. The patch introduces _safe_join(), which validates that the resolved path stays within the configured root_dir.

Workarounds

Remove or disable gr.FileExplorer components in production applications until upgrade is possible.
Run Gradio processes under a low-privilege user account with filesystem access restricted to the intended directory using OS-level controls such as chroot or containerization.
Place a reverse proxy in front of Gradio that inspects and rejects requests containing traversal sequences or absolute paths in JSON payload fields.

bash

# Upgrade Gradio to the patched release
pip install --upgrade 'gradio>=6.16.0'

# Verify the installed version
python -c "import gradio; print(gradio.__version__)"