CVE-2026-28414

What it actually does

CVE-2026-28414 is an unauthenticated arbitrary file read vulnerability in Gradio on Windows when running with Python 3.13 or later before Gradio 6.7. The issue stems from a Python 3.13 change to os.path.isabs behavior: Windows root-relative paths such as /windows/win.ini are no longer treated as absolute. Gradio’s path-safety logic can therefore incorrectly join and allow these paths, enabling a remote attacker to retrieve files from the server filesystem through Gradio file-serving functionality. The impact is confidentiality-only: attackers can read files accessible to the Gradio process, but the vulnerability does not directly provide file write, code execution, or service disruption.

Why it matters to the business

An exposed vulnerable Gradio application can leak sensitive local files from the Windows host, including configuration files, secrets, API keys, model-serving credentials, source code, environment data, or other files readable by the Gradio process. This is especially serious for AI prototyping and internal tool deployments because Gradio apps often run close to models, datasets, notebooks, credentials, and experiment artifacts. Although this vulnerability is not currently listed in CISA KEV and is not marked as ransomware-associated, the exploit maturity is weaponized and the attack requires no authentication, no user interaction, and low complexity, so internet-exposed Windows Gradio deployments should be treated as urgent.

How an attack unfolds

An attacker first identifies an internet-accessible or network-accessible Gradio application running on Windows with Python 3.13 or later and a Gradio version earlier than 6.7. The attacker then sends crafted requests to Gradio file-serving endpoints using Windows root-relative path syntax, for example paths beginning with /windows/ rather than a drive-qualified path such as C:\Windows\. Because vulnerable Gradio versions rely on path checks affected by the Python 3.13 os.path.isabs behavior change, the application may incorrectly treat the supplied path as safe after joining it with an allowed directory. If successful, the server returns the contents of the requested local file. The attacker can repeat this process to enumerate readable files, retrieve system files to confirm exploitation, and then target higher-value application files such as configuration, credential, source, notebook, or model-related files. Authentication configured on the Gradio app may not prevent exploitation if the vulnerable file-serving route is reachable without a valid session.

How to fix it

Upgrade Gradio to version 6.7 or later on all Windows deployments, especially those running Python 3.13 or newer. If package pinning is used, update requirements.txt, pyproject.toml, poetry.lock, Pipfile.lock, conda environment files, container images, and CI/CD build definitions so vulnerable Gradio versions are not reintroduced. If immediate upgrade is not possible, reduce exposure by placing the application behind a trusted reverse proxy or VPN, restricting network access to known users, disabling public access to file-serving features where feasible, and running the Gradio process under a least-privileged account with minimal filesystem read permissions. Treat authentication alone as insufficient mitigation because the vulnerability can be exploitable even when Gradio authentication is configured. Rotate any secrets stored on or readable from affected hosts if exploitation is suspected.

How to confirm the fix worked

Confirm the installed Gradio version is 6.7 or later using package inventory, pip show gradio, pip freeze, poetry show gradio, or the relevant software composition analysis tool. Confirm the runtime platform is not an exposed vulnerable combination of Windows, Python 3.13 or later, and Gradio before 6.7. Review deployed artifacts and container/base images to ensure old Gradio versions are not bundled. After upgrading, test that requests to Gradio file-serving routes using Windows root-relative paths such as /windows/win.ini or encoded equivalents do not return local file contents. Validate network controls by confirming only intended users or networks can reach the Gradio service. For suspected exposure, inspect web access logs around the publication date and afterward for file-read probes and successful HTTP 200 responses to suspicious file path requests.

Typical attack path

1. Discover a reachable Gradio application, commonly by HTTP fingerprinting, page content, headers, or known Gradio routes.
2. Determine whether the service is likely running a vulnerable Gradio version on Windows with Python 3.13 or later.
3. Send unauthenticated requests to Gradio file-serving routes using root-relative Windows paths such as /windows/win.ini.
4. Confirm file disclosure by retrieving a benign known Windows file.
5. Enumerate additional readable paths relevant to the application runtime, such as configuration files, environment files, source files, notebooks, logs, or credential material.
6. Use recovered secrets or operational data for follow-on access, lateral movement, model/data theft, or cloud/API compromise.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs from reverse proxies, load balancers, WAFs, application servers, and Gradio/Uvicorn logs for requests to file-serving endpoints that include Windows root-relative paths or encoded variants. Focus on requests returning HTTP 200, 206, or unusually large response sizes, especially when the requested path references known Windows files or sensitive application files. Look for unauthenticated requests to /file= or similar Gradio file routes containing /windows/, /winnt/, /users/, /programdata/, /appdata/, drive-like strings, encoded slashes (%2f or %5c), or double-encoded traversal-style payloads. Also review endpoint telemetry for unexpected reads by the Python or Gradio process against sensitive files, configuration directories, notebooks, credential stores, and Windows system files. If available, correlate web requests with file access auditing, EDR file-read events, Sysmon Event ID 11 or equivalent file access telemetry, and process command lines for python.exe, uvicorn, or gradio. Indicators of successful exploitation include repeated probing for /windows/win.ini, requests for application configuration or secret files, and successful responses to file endpoint requests from unauthenticated or unfamiliar IP addresses.

• GET /file=/windows/win.ini
• GET /file=/Windows/win.ini
• GET /file=/winnt/win.ini
• GET /file=%2Fwindows%2Fwin.ini
• GET /file=%2FWindows%2Fwin.ini
• GET /file=%2Fwinnt%2Fwin.ini
• /file=/windows/system32/drivers/etc/hosts
• /file=/Windows/System32/drivers/etc/hosts
• /file=%2Fwindows%2Fsystem32%2Fdrivers%2Fetc%2Fhosts
• /file=/users/
• /file=/Users/
• /file=%2Fusers%2F
• /file=%2FUsers%2F
• /file=/programdata/
• /file=/ProgramData/
• /file=%2Fprogramdata%2F
• /file=%2FProgramData%2F
• /file=/windows/system32/config/
• /file=/Windows/System32/config/
• /file=%2Fwindows%2Fsystem32%2Fconfig%2F
• /file=/windows/system.ini
• /file=/Windows/system.ini
• /file=%2Fwindows%2Fsystem.ini
• /file=/windows/
• /file=/Windows/
• /file=%2Fwindows%2F
• /file=%2FWindows%2F

What your security team should do

• Immediately inventory Gradio deployments and prioritize any Windows hosts running Python 3.13+ with Gradio versions earlier than 6.7.
• Upgrade all affected deployments to Gradio 6.7 or later and rebuild/redeploy packaged applications, containers, and virtual environments.
• Treat public-facing vulnerable instances as potentially exposed because exploitation is unauthenticated and weaponized.
• Restrict Gradio services to trusted networks or authenticated reverse proxies; do not rely solely on Gradio app authentication as a compensating control.
• Review HTTP access logs for suspicious file-serving requests containing Windows root-relative paths, encoded slashes, or known sensitive filenames.
• If evidence of exploitation exists, perform secret rotation for credentials, API keys, tokens, and configuration values that may have been readable by the Gradio process.
• Run the Gradio process with least-privilege filesystem access and separate sensitive files from the application runtime where possible.
• Add dependency monitoring or SCA policy to prevent deployment of Gradio versions earlier than 6.7 in Windows/Python 3.13+ environments.