CVE-2026-49119: 
Gradio vulnerability analysis and mitigation

CVE-2026-49119 is a path traversal vulnerability (CWE-22) in the FileExplorer component's preprocess() method of the Gradio Python library. It affects all Gradio versions before 6.16.0 and allows unauthenticated remote attackers to escape the configured root directory and read arbitrary files on the host system. The vulnerability was published on July 1, 2026, with a fix released in Gradio 6.16.0. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.7 (High) (Github Advisory, VulnCheck).

The root cause is an insecure use of os.path.join() combined with os.path.normpath() in FileExplorer.preprocess() to construct file paths from attacker-controlled path segments. When an absolute path segment (e.g., /etc/passwd) is supplied, Python's os.path.join() discards all preceding components — including the configured root_dir — causing the resulting path to point entirely outside the intended directory. Similarly, .. segments can be used to climb out of root_dir. This behavior was asymmetric with the component's ls() method, which already used the safer _safe_join() helper to reject such inputs. The constructed out-of-root path was then passed directly to developer-defined callbacks, enabling arbitrary file read. The vulnerability is reachable unauthenticated via the /queue/join endpoint on Gradio apps that do not require authentication (Github PR #13437, Github Commit).

Successful exploitation allows an unauthenticated network attacker to read arbitrary files accessible to the Gradio server process, bypassing the intended root_dir restriction. This poses a high confidentiality risk, potentially exposing sensitive system files (e.g., /etc/passwd, SSH keys, application secrets, environment files with credentials) to unauthorized parties. There is no integrity or availability impact, but credential exposure from leaked configuration files could facilitate lateral movement or privilege escalation (Github Advisory, VulnCheck).

No public proof-of-concept exploit code has been published, and there is no evidence of active in-the-wild exploitation as of the time of disclosure (Github Advisory). The vulnerability is classified as automatable (no user interaction or special privileges required), making it straightforward to exploit at scale against internet-exposed Gradio instances. The EPSS score is approximately 0.69% (48th percentile), indicating a moderate near-term exploitation probability. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing Gradio applications running versions prior to 6.16.0 using tools like Shodan or Censys, searching for Gradio's default HTTP interface (typically port 7860). Confirm the presence of a gr.FileExplorer component in the app's UI.
2. Identify the queue endpoint: Gradio apps expose a /queue/join WebSocket or HTTP endpoint used to submit component inputs for processing. Confirm the endpoint is accessible without authentication.
3. Craft malicious payload: Construct a FileExplorerData payload with path segments designed to escape root_dir. Two effective techniques are:
   • Absolute path: Supply ["/etc/passwd"] as the selected path segment, causing os.path.join(root_dir, "/etc/passwd") to discard root_dir entirely.
   • Directory traversal: Supply [".." , "..", "etc", "passwd"] to climb out of root_dir using .. segments.
4. Submit the payload: Send the crafted payload to the /queue/join endpoint targeting the FileExplorer component's input, triggering preprocess() to resolve the attacker-controlled path.
5. Retrieve file contents: The resolved out-of-root path is passed to the developer's callback function, which may read and return the file contents to the attacker via the Gradio response (Github PR #13437, Github Commit).

• Network: Unexpected HTTP/WebSocket requests to /queue/join containing path segments with absolute paths (e.g., /etc/passwd, /root/.ssh/id_rsa) or .. sequences in FileExplorer component data; unusual outbound data transfers from the Gradio server.
• Logs: Gradio application logs showing FileExplorer preprocess calls with path values outside the configured root_dir; access log entries to /queue/join with anomalous or encoded path payloads from unexpected source IPs.
• File System: No direct file system artifacts are created by this read-only vulnerability, but audit logs may show unexpected file reads of sensitive files (e.g., /etc/passwd, /etc/shadow, .env files, SSH keys) by the Gradio process.
• Process: The Gradio server process (python) accessing files outside its expected working directory or root_dir as observed via system call auditing tools (e.g., auditd, strace).

The primary remediation is to upgrade Gradio to version 6.16.0 or later, which fixes the vulnerability by routing both file_count="single" and file_count="multiple" branches of preprocess() through the _safe_join() helper, rejecting absolute paths and .. traversal sequences with an InvalidPathError (Gradio Release). As a workaround for environments that cannot immediately upgrade, restrict network access to Gradio instances using firewalls or reverse proxies, and enable authentication (auth=) on all Gradio apps to reduce the unauthenticated attack surface. Additionally, consider running the Gradio process under a least-privilege user account to limit the files accessible even if path traversal is achieved.

The fix was developed by Gradio maintainer abidlabs and merged on May 31, 2026, ahead of the public disclosure on July 1, 2026 with the Gradio 6.16.0 release (Gradio Release). VulnCheck assigned and published the CVE advisory. The NixOS security tracker opened a tracking issue (NixOS/nixpkgs#538207) to address the vulnerability in the nixpkgs package repository (Github PR #13437). No significant broader media coverage or notable public researcher commentary has been identified beyond the standard advisory publications.