AI agent vulnerability · Gradio

CVE-2023-41626: Gradio arbitrary file upload vulnerability

mediumCVSS 3.1 4.8GHSA-v4q9-qgqf-7jwp

Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface.

Published Sep 16, 2023 · Updated Nov 12, 2023

Affected packages

gradio

Ecosystem: PyPI
Affected: <= 3.27.0
Fixed in: No patched version yet
Check: pip show gradio

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-41626
https://gist.github.com/impose1/590472eb0544ef1ec36c8a5a40122adb
https://github.com/advisories/GHSA-v4q9-qgqf-7jwp

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Gradio vulnerabilities

All Gradio entries

CVE-2026-49119
Gradio FileExplorer preprocess path traversal allows files outside root_dir to reach callbacks
high7.5Jul 1, 2026
CVE-2026-10783
Gradio: Audio cache key ignores metadata when saving numpy audio outputs
low2.5Jun 4, 2026
CVE-2026-48545
Gradio contains a cookie injection vulnerability
high6.8May 27, 2026
CVE-2026-27167
Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret
lowMar 1, 2026
CVE-2026-28414
Gradio is Vulnerable to Absolute Path Traversal on Windows with Python 3.13+
high7.5Mar 1, 2026
CVE-2026-28415
Gradio has an Open Redirect in its OAuth Flow
medium4.3Mar 1, 2026