Gradio-app vulnerabilities
50 CVEs and advisories name Gradio-app as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-59806Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint
- CVE-2026-49119Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()
- CVE-2026-10783gradio-app gradio Audio Cache Key save_audio_to_cache weak hash
- CVE-2026-48545Gradio < 6.15.0 Cookie Injection via Shared Proxy Client
- CVE-2026-28416Gradio has SSRF via Malicious `proxy_url` Injection in `gr.load()` Config Processing
- CVE-2026-28415Gradio has Open Redirect in OAuth Flow
- CVE-2026-28414Gradio has Absolute Path Traversal on Windows with Python 3.13+
- CVE-2026-27167Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
- CVE-2025-48889Gradio Allows Unauthorized File Copy via Path Manipulation
- CVE-2025-5320gradio-app gradio CORS is_valid_origin privilege escalation
- CVE-2024-8021Open Redirect in gradio-app/gradio
- CVE-2024-10648Path Traversal in gradio-app/gradio
- CVE-2024-12217Path Traversal in gradio-app/gradio
- CVE-2024-8966Denial of Service in gradio-app/gradio
- CVE-2024-10569Zip Bomb Vulnerability in gradio-app/gradio
- CVE-2024-10624Regular Expression Denial of Service (ReDoS) in gradio-app/gradio
- CVE-2025-0187Denial of Service (DoS) by Sending Large Filename at File Upload Endpoint in gradio-app/gradio
- CVE-2025-23042Gradio Blocked Path ACL Bypass Vulnerability
- CVE-2024-51751Arbitrary file read with File and UploadButton components in Gradio
- CVE-2024-47867Lack of integrity check on the downloaded FRP client in Gradio
- CVE-2024-47868Several components’ post-process steps may allow arbitrary file leaks in Gradio
- CVE-2024-47869Non-constant-time comparison when comparing hashes in Gradio
- CVE-2024-47870Race condition in update_root_in_config may redirect user traffic in Gradio
- CVE-2024-47871Insecure communication between the FRP client and server in Gradio
- CVE-2024-47872Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files
- CVE-2024-47084CORS origin validation is not performed when the request has a cookie in Gradio
- CVE-2024-47164The `is_in_or_equal` function may be bypassed in Gradio
- CVE-2024-47165CORS origin validation accepts the null origin in Gradio
- CVE-2024-47166One-level read path traversal in `/custom_component` in Gradio
- CVE-2024-47167SSRF in the path parameter of /queue/join in Gradio