Gradio FileExplorer Path Traversal Vulnerability CVE-2026-49119

# Gradio FileExplorer Path Traversal Vulnerability CVE-2026-49119

https://gcdradar.vercel.app/incidents/gradio-fileexplorer-path-traversal-vulnerability-cve-2026-49 · AIR-2026-0036 · closed 2026-07-01

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability)
- Fix status: Fix status unknown
- First reported: 2026-07-01
- AI role: Attack on AI
- Products: Gradio
- CVE ids: CVE-2026-49119
- CVSS: 8.7

## Summary

Gradio contains a path traversal vulnerability in the FileExplorer component that permits unauthenticated attackers to escape the configured root directory. Attackers can leverage this flaw to perform arbitrary file reads and expose sensitive files.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-07-01: CVE-2026-49119: Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows… (https://nvd.nist.gov/vuln/detail/CVE-2026-49119)
- 2026-07-01: CVE-2026-49119:  Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacks (https://github.com/advisories/GHSA-j36p-7w88-g82j)

## Sources

- 2026-07-01 GitHub Advisory Database: CVE-2026-49119:  Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacks https://github.com/advisories/GHSA-j36p-7w88-g82j
- 2026-07-01 NVD: CVE-2026-49119: Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows… https://nvd.nist.gov/vuln/detail/CVE-2026-49119

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.