Skip to contentGradio Project Gradio vulnerabilities
- gradio-app gradioGradio < 6.16.0 Path Traversal via FileExplorer.preprocess()CVE-2026-49119Fix available8.7 High
- gradio-app gradiogradio-app gradio Audio Cache Key save_audio_to_cache weak hashCVE-2026-10783Fix available2.0 Low
- gradio-app gradioGradio < 6.15.0 Cookie Injection via Shared Proxy ClientCVE-2026-48545Fix available7.6 High
- gradio-app gradioGradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config ProcessingCVE-2026-28416Fix available8.2 High
- gradio-app gradioGradio has Open Redirect in OAuth FlowCVE-2026-28415Fix available4.3 Medium
- gradio-app gradioGradio has Absolute Path Traversal on Windows with Python 3.13+CVE-2026-28414Fix available7.5 High
- gradio-app gradioGradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session SecretCVE-2026-27167Fix available0.0 None
- gradio-app gradioGradio Allows Unauthorized File Copy via Path ManipulationCVE-2025-48889Fix available5.3 Medium
- gradio-app gradio-app/gradio, gradio project gradio +1 moreOpen Redirect in gradio-app/gradioCVE-2024-80215.4 Medium
- gradio-app gradio-app/gradio, gradio project gradio +1 morePath Traversal in gradio-app/gradioCVE-2024-106488.2 High
- gradio-app gradio-app/gradio, gradio project gradio +1 moreZip Bomb Vulnerability in gradio-app/gradioCVE-2024-105697.5 High
- gradio-app gradio-app/gradio, gradio project gradio +1 moreRegular Expression Denial of Service (ReDoS) in gradio-app/gradioCVE-2024-106247.5 High
- gradio-app gradio-app/gradio, gradio project gradio +1 moreDenial of Service (DoS) by Sending Large Filename at File Upload Endpoint in gradio-app/gradioCVE-2025-01877.5 High
- gradio-app gradioGradio Blocked Path ACL Bypass VulnerabilityCVE-2025-23042Fix available8.7 High
- gradio-app gradioArbitrary file read with File and UploadButton components in GradioCVE-2024-51751Fix available6.5 Medium
- gradio project gradiogradio Server Side Request Forgery vulnerabilityCVE-2024-480526.5 Medium
- gradio-app gradioCross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG filesCVE-2024-47872Fix available6.9 Medium
- gradio-app gradioInsecure communication between the FRP client and server in GradioCVE-2024-47871Fix available8.2 High
- gradio-app gradioRace condition in update_root_in_config may redirect user traffic in GradioCVE-2024-47870Fix available7.1 High
- gradio-app gradioNon-constant-time comparison when comparing hashes in GradioCVE-2024-47869Fix available2.3 Low
- gradio-app gradioSeveral components’ post-process steps may allow arbitrary file leaks in GradioCVE-2024-47868Fix available6.3 Medium
- gradio-app gradioLack of integrity check on the downloaded FRP client in GradioCVE-2024-47867Fix available2.1 Low
- gradio-app gradioSSRF in the path parameter of /queue/join in GradioCVE-2024-47167Public exploitFix available6.9 Medium
- gradio-app gradioThe `enable_monitoring` flag set to `False` does not disable monitoring in GradioCVE-2024-47168Fix available2.3 Low
- gradio-app gradioOne-level read path traversal in `/custom_component` in GradioCVE-2024-47166Fix available2.3 Low
- gradio-app gradioCORS origin validation accepts the null origin in GradioCVE-2024-47165Fix available6.9 Medium
- gradio-app gradioThe `is_in_or_equal` function may be bypassed in GradioCVE-2024-47164Fix available2.3 Low
- gradio-app gradioCORS origin validation is not performed when the request has a cookie in GradioCVE-2024-47084Fix available6.9 Medium
- gradio project gradioWithdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.pyCVE-2024-39236Disputed9.8 Critical
- gradio-app gradio-app/gradio, gradio project gradio +1 moreOpen Redirect in gradio-app/gradioCVE-2024-49405.4 Medium
- gradio-app gradio-app/gradio, gradio project gradio +1 moreServer-Side Request Forgery (SSRF) in gradio-app/gradioCVE-2024-4325EPSS 37.1%8.6 High
- gradio-app gradio-app/gradio, gradio project gradio +1 moreLocal File Inclusion in JSON component in gradio-app/gradioCVE-2024-4941Fix available7.5 High
- gradio-app gradio-app/gradio, gradio project gradio +1 moreSecrets Exfiltration in gradio-app/gradioCVE-2024-4254Public exploit7.1 High
- gradio-app gradio-app/gradio, gradio project gradio +1 moreCommand Injection in gradio-app/gradioCVE-2024-4253Public exploitFix available7.5 High
- gradio project gradioGradio allows credential leakage on WindowsCVE-2024-34510Fix available7.5 High
- gradio-app gradio-app/gradio, gradio project gradio +1 moreArbitrary Local File Read via Component Method Invocation in gradio-app/gradioCVE-2024-1561Public exploitFix available7.5 High
- gradio-app gradio-app/gradio, gradio project gradio +1 moreSSRF Vulnerability in gradio-app/gradioCVE-2024-1183Fix available6.5 Medium
- gradio-app gradio-app/gradio, gradio project gradio +1 moreLocal File Inclusion in gradio-app/gradioCVE-2024-1728Fix availableEPSS 85.4%7.5 High
- gradio-app gradio-app/gradio, gradio app gradio +1 moreCommand Injection in gradio-app/gradio via deploy+test-visual.yml workflowCVE-2024-1540Public exploit8.6 High
- gradio-app gradio-app/gradio, gradio project gradio +1 moreSSRF Vulnerability in gradio-app/gradioCVE-2024-2206Fix available7.3 High
- gradio-app gradio-app/gradio, gradio project gradio +1 moreCSRF Vulnerability in gradio-app/gradioCVE-2024-1727Fix available4.3 Medium
- gradio-app gradio-app/gradio, gradio project gradio +1 moreTiming Attack Vulnerability in gradio-app/gradioCVE-2024-1729Fix available5.9 Medium
- gradio app gradio, gradio-app gradio-app/gradio +1 moreLFI in GradioCVE-2024-0964Fix available7.5 High
- gradio-app gradioMake the `/file` secure against file traversal attacksCVE-2023-51449Fix availableEPSS 28.3%5.6 Medium
- gradio-app gradio-app/gradio, gradio project gradio +1 moreCommand Injection in gradio-app/gradioCVE-2023-6572Public exploitFix available9.6 Critical
- gradio project gradioGradio arbitrary file upload vulnerabilityCVE-2023-416264.8 Medium
- gradio-app gradioUnfiltered paths in gradioCVE-2023-34239Fix available7.3 High
- gradio-app gradioGradio contains Use of Hard-coded CredentialsCVE-2023-25823Fix available5.4 Medium
- gradio-app gradioImproper Neutralization of Formula Elements in a CSV File in Gradio FlaggingCVE-2022-24770Fix available8.8 High
- gradio-app gradioFiles on the host computer can be accessed from the Gradio interfaceCVE-2021-43831Fix available7.7 High