CVE-2026-49119

描述

Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured root directory by supplying path segments containing directory traversal sequences or absolute paths. Attackers can provide crafted path segments that cause os.path.join to discard the root_dir prefix entirely, resulting in arbitrary file read or exposure of sensitive files outside the intended directory.

如何修補 CVE-2026-49119

要修補 CVE-2026-49119,請將受影響套件升級到下列已修補版本。

• PyPI/gradio—升級至 6.16.0 或更新版本

CVE-2026-49119 正在被利用嗎?

低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 6.16.0

CVSS 分數

參考連結(4)

• ADVISORYgithub.com/gradio-app/gradio/releases/tag/gradio%406.16.0
• PATCHgithub.com/gradio-app/gradio/commit/97d541f3d5fd05b2587a69ecc94b68fe5d2d7004
• PATCHgithub.com/gradio-app/gradio/pull/13437
• PATCHwww.vulncheck.com/advisories/gradio-path-traversal-via-fileexplorer-preprocess