GHSA-39mp-8hj3-5c49
High · 7.5CVSS
7.5
EPSS
—
Published
Mar 1, 2026
CISA due date
—
The record
Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | gradio | 0 | 6.7.0 |
Related vulnerabilities
- CVE-2026-28414 Gradio is an open-source Python package designed for quick prototyping. Same vulnerability
- GHSA-jmh7-g254-2cq9 Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing Also affects gradio
- GHSA-pfjf-5gxr-995x Gradio has an Open Redirect in its OAuth Flow Also affects gradio
- GHSA-h3h8-3v2v-rg7m Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret Also affects gradio
- CVE-2026-28415 Gradio is an open-source Python package designed for quick prototyping. Also affects gradio
- CVE-2026-28416 Gradio is an open-source Python package designed for quick prototyping. Also affects gradio
- CVE-2026-27167 Gradio is an open-source Python package designed for quick prototyping. Also affects gradio
- CVE-2025-5320 A vulnerability classified as problematic has been found in gradio-app gradio up to… Also affects gradio