CVE-2026-28414 PoC — Gradio 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-28414.yaml

Associated Vulnerability

Title:Gradio 安全漏洞 (CVE-2026-28414)
Description:Gradio是Gradio开源的一个开源 Python 库，是通过友好的 Web 界面演示机器学习模型的方法。 Gradio 6.7之前版本存在安全漏洞，该漏洞源于Python 3.13+中os.path.isabs定义变更导致绝对路径遍历逻辑缺陷，可能导致未经验证的攻击者从文件系统读取任意文件。

Description

Gradio < 6.7 on Windows with Python 3.13+ contains an absolute path traversal caused by incorrect path validation in path joining logic, letting unauthenticated attackers read arbitrary files from the server.

File Snapshot


 id: CVE-2026-28414

info:
  name: Gradio - Absolute Path Traversal
  author: 0x_Akoko
  severity: hi

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!