{
 "id": "AIR-2026-0036",
 "slug": "gradio-fileexplorer-path-traversal-vulnerability-cve-2026-49",
 "title": "Gradio FileExplorer Path Traversal Vulnerability CVE-2026-49119",
 "summary": "Gradio contains a path traversal vulnerability in the FileExplorer component that permits unauthenticated attackers to escape the configured root directory. Attackers can leverage this flaw to perform arbitrary file reads and expose sensitive files.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Gradio"
 ],
 "incident_date": "2026-07-01",
 "incident_date_precision": "day",
 "first_reported": "2026-07-01",
 "sources": [
  {
   "url": "https://github.com/advisories/GHSA-j36p-7w88-g82j",
   "publisher": "GitHub Advisory Database",
   "title": "CVE-2026-49119:  Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacks",
   "published_at": "2026-07-01"
  },
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49119",
   "publisher": "NVD",
   "title": "CVE-2026-49119: Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows…",
   "published_at": "2026-07-01"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_ghsa",
 "tags": [
  "CVE-2026-49119",
  "path-traversal",
  "arbitrary-file-read"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}