CVE-2026-35485 — HIGH (CVSS 7.5)

CISO Take

An unauthenticated path traversal in text-generation-webui prior to v4.3 allows any network-reachable attacker to read arbitrary files from the server filesystem — including API keys, .env files, model configs, and system credentials — by submitting directory traversal payloads (e.g., ../../../etc/passwd) via the Gradio API. The attack requires zero authentication, zero user interaction, and low complexity (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), making it trivially exploitable by anyone who can reach port 7860. Text-generation-webui is one of the most widely deployed open-source LLM frontends in enterprise AI labs and research environments, meaning the blast radius extends to every AI provider API key and credential co-located on the host. Upgrade to v4.3 immediately; if patching is blocked, place the service behind an authenticated reverse proxy and block direct external access.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High risk, particularly for teams running text-generation-webui in internal AI labs, research clusters, or developer workstations with network exposure. The zero-prerequisite exploit bar (no account, no prior access, no user click) means any instance reachable from the internet or a flat internal network is fully exposed. While not yet in CISA KEV and EPSS is unavailable, the trivial exploitation path and public advisory disclosure means active scanning will begin quickly post-announcement. The absence of extension restrictions on file reads amplifies impact beyond config files to private key material, model weight paths, and cloud provider credentials stored on the host.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
gradio	pip	—	No patch
42.6K OpenSSF 5.5 675 dependents Pushed 7d ago 27% patched ~110d to patch Full package profile →

Do you use gradio? You're affected.

Severity & Risk

CVSS 3.1

7.5 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 68% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch: Upgrade text-generation-webui to v4.3 or later. No workaround substitutes for the fix.
Network isolation: If immediate patching is blocked, restrict access via firewall to trusted IPs only and place behind an authenticated reverse proxy (nginx + OAuth2/Basic Auth).
Detection: Search web/application logs for requests containing '../', '%2e%2e%2f', or '%2e%2e/' in any API parameter. Alert on any grammar-related endpoint calls from untrusted sources.
Credential rotation: If exposure cannot be ruled out, rotate all API keys, tokens, and passwords stored on the affected host immediately.
Audit scope: Inventory all Gradio-based ML UIs in your environment and verify they independently validate file-path inputs server-side, not relying solely on Gradio's client-side controls.

CISA SSVC Assessment

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Data Extraction Auth Bypass Inference Framework AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials

Compliance Impact

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system design and development inputs

NIST AI RMF

MANAGE-2.2 - Risk response — AI risk prioritization and treatment

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-35485?

An unauthenticated path traversal in text-generation-webui prior to v4.3 allows any network-reachable attacker to read arbitrary files from the server filesystem — including API keys, .env files, model configs, and system credentials — by submitting directory traversal payloads (e.g., ../../../etc/passwd) via the Gradio API. The attack requires zero authentication, zero user interaction, and low complexity (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), making it trivially exploitable by anyone who can reach port 7860. Text-generation-webui is one of the most widely deployed open-source LLM frontends in enterprise AI labs and research environments, meaning the blast radius extends to every AI provider API key and credential co-located on the host. Upgrade to v4.3 immediately; if patching is blocked, place the service behind an authenticated reverse proxy and block direct external access.

Is CVE-2026-35485 actively exploited?

No confirmed active exploitation of CVE-2026-35485 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35485?

1. Patch: Upgrade text-generation-webui to v4.3 or later. No workaround substitutes for the fix. 2. Network isolation: If immediate patching is blocked, restrict access via firewall to trusted IPs only and place behind an authenticated reverse proxy (nginx + OAuth2/Basic Auth). 3. Detection: Search web/application logs for requests containing '../', '%2e%2e%2f', or '%2e%2e/' in any API parameter. Alert on any grammar-related endpoint calls from untrusted sources. 4. Credential rotation: If exposure cannot be ruled out, rotate all API keys, tokens, and passwords stored on the affected host immediately. 5. Audit scope: Inventory all Gradio-based ML UIs in your environment and verify they independently validate file-path inputs server-side, not relying solely on Gradio's client-side controls.

What systems are affected by CVE-2026-35485?

This vulnerability affects the following AI/ML architecture patterns: LLM inference serving, ML UI deployments, local AI development environments, enterprise LLM gateways.

What is the CVSS score for CVE-2026-35485?

CVE-2026-35485 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.56%.

Technical Details

NVD Description

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_grammar() allows reading any file on the server filesystem with no extension restriction. Gradio does not server-side validate dropdown values, so an attacker can POST directory traversal payloads (e.g., ../../../etc/passwd) via the API and receive the full file contents in the response. This vulnerability is fixed in 4.3.

Exploitation Scenario

An attacker enumerates internal AI infrastructure or finds an internet-exposed instance via Shodan (port 7860 is the default Gradio port). They send a POST request to the grammar loader API endpoint, replacing a legitimate grammar filename with a traversal payload such as '../../../home/user/.env' or '../../../opt/aithreatintel/.env'. Gradio forwards the value to load_grammar() without server-side validation; the application opens and reads the file, returning the full contents in the API JSON response. The attacker harvests API keys for OpenAI, Anthropic, and Hugging Face, along with database credentials. They then abuse the exfiltrated AI provider keys to run inference at the victim's expense or access proprietary model data, and use database credentials for further lateral movement into backend systems.