Gradio arbitrary file upload vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-41626 · ADVISORY
• gist.github.com/impose1/590472eb0544ef1ec36c8a5a40122adb · WEB
• gradio-app/gradio · PACKAGE
• pypi.org/project/gradio · PACKAGE
• GitHub Advisory GHSA-v4q9-qgqf-7jwp · ADVISORY

gradio의 다른 취약점

• CVE-2026-49119높음 7.5Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated …
• CVE-2026-10783낮음 2.5A security flaw has been discovered in gradio-app gradio 6.14.0. This affects the function save_audio_to_cache of the component Audio Cache …
• CVE-2026-48545보통 6.8Gradio before version 6.15.0 contains a cookie injection vulnerability that allows remote attackers to perform cross-Space session fixation …
• CVE-2026-28416높음 8.6Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, a Server-Side Request Forgery (SSRF) vulnera…
• CVE-2026-28415보통 4.7Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target() function in Gradio…