CVE-2026-35485: text-generation-webui: unauthenticated path traversal file read

HIGH

Published April 7, 2026

CISO Take

An unauthenticated path traversal in text-generation-webui prior to v4.3 allows any network-reachable attacker to read arbitrary files from the server filesystem — including API keys, .env files, model configs, and system credentials — by submitting directory traversal payloads (e.g., ../../../etc/passwd) via the Gradio API. The attack requires zero authentication, zero user interaction, and low complexity (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), making it trivially exploitable by anyone who can reach port 7860. Text-generation-webui is one of the most widely deployed open-source LLM frontends in enterprise AI labs and research environments, meaning the blast radius extends to every AI provider API key and credential co-located on the host. Upgrade to v4.3 immediately; if patching is blocked, place the service behind an authenticated reverse proxy and block direct external access.

Sources: NVD GitHub Advisory ATLAS

Risk Assessment

High risk, particularly for teams running text-generation-webui in internal AI labs, research clusters, or developer workstations with network exposure. The zero-prerequisite exploit bar (no account, no prior access, no user click) means any instance reachable from the internet or a flat internal network is fully exposed. While not yet in CISA KEV and EPSS is unavailable, the trivial exploitation path and public advisory disclosure means active scanning will begin quickly post-announcement. The absence of extension restrictions on file reads amplifies impact beyond config files to private key material, model weight paths, and cloud provider credentials stored on the host.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
gradio	pip	—	No patch
42.3K OpenSSF 5.8 634 dependents Pushed 3d ago 26% patched ~110d to patch Full package profile →

Do you use gradio? You're affected.

Severity & Risk

CVSS 3.1

7.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

Recommended Action

Patch: Upgrade text-generation-webui to v4.3 or later. No workaround substitutes for the fix.
Network isolation: If immediate patching is blocked, restrict access via firewall to trusted IPs only and place behind an authenticated reverse proxy (nginx + OAuth2/Basic Auth).
Detection: Search web/application logs for requests containing '../', '%2e%2e%2f', or '%2e%2e/' in any API parameter. Alert on any grammar-related endpoint calls from untrusted sources.
Credential rotation: If exposure cannot be ruled out, rotate all API keys, tokens, and passwords stored on the affected host immediately.
Audit scope: Inventory all Gradio-based ML UIs in your environment and verify they independently validate file-path inputs server-side, not relying solely on Gradio's client-side controls.

Classification

Data Extraction Auth Bypass Inference Framework AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials

Compliance Impact

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system design and development inputs

NIST AI RMF

MANAGE-2.2 - Risk response — AI risk prioritization and treatment

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Technical Details

NVD Description

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_grammar() allows reading any file on the server filesystem with no extension restriction. Gradio does not server-side validate dropdown values, so an attacker can POST directory traversal payloads (e.g., ../../../etc/passwd) via the API and receive the full file contents in the response. This vulnerability is fixed in 4.3.

Exploitation Scenario

An attacker enumerates internal AI infrastructure or finds an internet-exposed instance via Shodan (port 7860 is the default Gradio port). They send a POST request to the grammar loader API endpoint, replacing a legitimate grammar filename with a traversal payload such as '../../../home/user/.env' or '../../../opt/aithreatintel/.env'. Gradio forwards the value to load_grammar() without server-side validation; the application opens and reads the file, returning the full contents in the API JSON response. The attacker harvests API keys for OpenAI, Anthropic, and Hugging Face, along with database credentials. They then abuse the exfiltrated AI provider keys to run inference at the victim's expense or access proprietary model data, and use database credentials for further lateral movement into backend systems.