CVE-2026-49119: Gradio FileExplorer path traversal
CVE-2026-49119 is verified against gradio-app/gradio · github affected versions: < 6.16.0 fixed version: 6.16.0 vulnerability class: Path Traversal This high reproduction includes runnable sandbox proof, artifacts, and a plain-text agent view under REPRO-2026-00246.
pruva-verify REPRO-2026-00246 curl -O https://pruva.dev/api/v1/reproductions/REPRO-2026-00246/artifacts/bundle/repro/reproduction_steps.sh && chmod +x reproduction_steps.sh && ./reproduction_steps.sh Gradio before 6.16.0 has a path traversal vulnerability in the FileExplorer component's preprocess() method. An unauthenticated attacker can supply directory traversal sequences to escape the configured root directory and read arbitrary files. Reproduce: run a Gradio app <6.16.0 with a FileExplorer component, send a request with path traversal segments, and observe that files outside the root are read.
Variant analysis
The agent's step-by-step process — every tool call, every handoff, the moment the exploit fired. Phases: support triages the advisory · repro reproduces it · vuln_variant confirms the fix blocks it · judge verifies.
Loading session...
Scripts, logs, diffs, and output captured during the reproduction.