What is CVE-2026-28414?

CVE-2026-28414 is a high-severity vulnerability in Gradio-App Gradio, classified under Absolute Path Traversal. CVSS score: 7.5/10. Published 2026-02-27.

How severe is CVE-2026-28414?

High severity. CVSS v3 base score is 7.5 out of 10.

Path Traversal in Gradio-App Gradio

CVE-2026-28414

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to an absolute path traversal issue that enables unauthenticated attackers to read arbitrary files from the file system. Python 3.13+ changed the definition of `os.path.isabs` so that root-relative paths like `/windows/win.ini` on Windows are no longer considered absolute paths, resulting in a vulnerability in Gradio's logic for joining paths safely. This can be exploited by unauthenticated attackers to read arbitrary files from the Gradio server, even when Gradio is set up with authentication. Version 6.7 fixes the issue.

Published 2026-02-27 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.025 (84.0th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 84th percentile — 84.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.031 · newest: 0.025 · change: -0.006

Affected products

Gradio-App Gradio — versions < 6.7
Gradio Project

Weakness classification (CWE)

References

github.com/gradio-app/gradio/security/advisories/GHSA-39mp-8hj3-5c49 (Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2026-28414?: CVE-2026-28414 is a high-severity vulnerability in Gradio-App Gradio, classified under Absolute Path Traversal. CVSS score: 7.5/10. Published 2026-02-27.
How severe is CVE-2026-28414?: High severity. CVSS v3 base score is 7.5 out of 10.