CVE-2026-28414

描述

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. Python 3.13+ changed the definition of `os.path.isabs` so that root-relative paths like `/windows/win.ini` on Windows are no longer considered absolute paths, resulting in a vulnerability in Gradio's logic for joining paths safely. This can be exploited by unauthenticated attackers to read arbitrary files from the Gradio server, even when Gradio is set up with authentication. Version 6.7 fixes the issue.

如何修補 CVE-2026-28414

要修補 CVE-2026-28414,請將受影響套件升級到下列已修補版本。

• —升級至 6.7.0 或更新版本
• —升級至 6.7.0 或更新版本

CVE-2026-28414 正在被利用嗎?

低 — EPSS 為 3.1%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 6.7.0
• from 0, < 6.7.0

CVSS 分數

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-28414
• PATCHgithub.com/gradio-app/gradio
• WEBgithub.com/gradio-app/gradio/commit/6011b00d0154b85532fa901dd73cf8fa7d86fd04
• WEBgithub.com/gradio-app/gradio/security/advisories/GHSA-39mp-8hj3-5c49