CVE-2026-28414: Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+

March 1, 2026 (updated June 6, 2026)

Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system.

References

github.com/advisories/GHSA-39mp-8hj3-5c49
github.com/gradio-app/gradio/commit/6011b00d0154b85532fa901dd73cf8fa7d86fd04
github.com/gradio-app/gradio/security/advisories/GHSA-39mp-8hj3-5c49
github.com/pypa/advisory-database/tree/main/vulns/gradio/PYSEC-2026-64.yaml
nvd.nist.gov/vuln/detail/CVE-2026-28414

Code Behaviors & Features

Detect and mitigate CVE-2026-28414 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →