Executive brief
Gradio, a popular library for building machine learning web interfaces, is vulnerable to a security flaw when running on Windows with Python 3.13 or newer. This vulnerability allows an attacker to bypass security restrictions and read sensitive files directly from the server's hard drive. This could lead to the exposure of private data, configuration files, or credentials, even if the application is configured to require a password.
Technical details
An absolute path traversal vulnerability exists in Gradio when deployed on Windows environments using Python 3.13+. The root cause is a change in Python 3.13's 'os.path.isabs' behavior, where root-relative paths (e.g., '/windows/win.ini') are no longer identified as absolute paths, causing Gradio's internal path-joining logic to fail its safety checks. An unauthenticated remote attacker can exploit this by sending specially crafted HTTP requests to the '/static/' endpoint to retrieve arbitrary files from the host operating system. The vulnerability is present even when authentication is enabled on the Gradio app. This issue is resolved in version 6.7.0.
Affected products
- gradio-app gradio < 6.7.0
Timeline
- 2026-02-27: disclosed
- 2026-03-01: advisory: GitHub Advisory published
- 2026-06-06: patched: Last updated/patch confirmed in version 6.7.0