CVE-2026-49119: Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacks

FileExplorer.preprocess() builds the selected path from the segments the browser sends. It used os.path.join(self.root_dir, *segments) followed by os.path.normpath(). When a segment is an absolute path such as /etc/passwd, os.path.join throws away the root_dir prefix. .. segments can also climb out of the root. The resulting path went to the developer's callback. The component's ls() method already used _safe_join and was not affected.

The flaw does not read a file by itself. It hands an attacker-chosen path to your function. If that function opens, returns or serves the file, as a typical file viewer does, the attacker reads any file the Gradio process can read. That includes config files, SSH keys and environment secrets. The attacker needs only network access to the app: the CVSS vector has no privileges and no user interaction.

Apps that expose a Gradio interface publicly or on a shared network and use FileExplorer are the ones at risk.

Affected: pip gradio before 6.16.0, in apps that use the gr.FileExplorer component. Apps that do not use that component are not exposed through this flaw.

pip show gradio

Search your code for FileExplorer to see which apps use it, and read what their callbacks do with the received path.

Upgrade to gradio 6.16.0.

pip install --upgrade "gradio>=6.16.0"

Per the fix pull request, both the single and multiple file modes of preprocess() now call _safe_join, the validation ls() already used. Out-of-root paths raise InvalidPathError. The sources give no other workaround. Until you upgrade, validate the path inside your own callback and reject anything that resolves outside root_dir.

Look in the app's request logs for calls to the FileExplorer event with an absolute path or .. in the selected path. Check for InvalidPathError after upgrading, which would show attempts. In your callback code, check whether it logs the file paths it opens, and look for reads of files such as /etc/passwd or ~/.ssh/ keys. Treat secrets on the host as exposed if you find them.

Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured root directory by supplying path segments containing directory traversal sequences or absolute paths. Attackers can provide crafted path segments that cause os.path.join to discard the root_dir prefix entirely, resulting in arbitrary file read or exposure of sensitive files outside the intended directory.