CVE-2026-35485: Gradio unauthenticated path traversal

CISO Take

An unauthenticated path traversal in text-generation-webui prior to v4.3 allows any network-reachable attacker to read arbitrary files from the server filesystem — including API keys, .env files, model configs, and system credentials — by submitting directory traversal payloads (e.g., ../../../etc/passwd) via the Gradio API. The attack requires zero authentication, zero user interaction, and low complexity (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), making it trivially exploitable by anyone who can reach port 7860. Text-generation-webui is one of the most widely deployed open-source LLM frontends in enterprise AI labs and research environments, meaning the blast radius extends to every AI provider API key and credential co-located on the host. Upgrade to v4.3 immediately; if patching is blocked, place the service behind an authenticated reverse proxy and block direct external access.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

High risk, particularly for teams running text-generation-webui in internal AI labs, research clusters, or developer workstations with network exposure. The zero-prerequisite exploit bar (no account, no prior access, no user click) means any instance reachable from the internet or a flat internal network is fully exposed. While not yet in CISA KEV and EPSS is unavailable, the trivial exploitation path and public advisory disclosure means active scanning will begin quickly post-announcement. The absence of extension restrictions on file reads amplifies impact beyond config files to private key material, model weight paths, and cloud provider credentials stored on the host.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Gradio	pip	—	No patch
43.1K OpenSSF 5.6 660 dependents Pushed 5d ago 27% patched ~107d to patch Full package profile →

Do you use Gradio? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 48% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

5 steps

Patch: Upgrade text-generation-webui to v4.3 or later. No workaround substitutes for the fix.
Network isolation: If immediate patching is blocked, restrict access via firewall to trusted IPs only and place behind an authenticated reverse proxy (nginx + OAuth2/Basic Auth).
Detection: Search web/application logs for requests containing '../', '%2e%2e%2f', or '%2e%2e/' in any API parameter. Alert on any grammar-related endpoint calls from untrusted sources.
Credential rotation: If exposure cannot be ruled out, rotate all API keys, tokens, and passwords stored on the affected host immediately.
Audit scope: Inventory all Gradio-based ML UIs in your environment and verify they independently validate file-path inputs server-side, not relying solely on Gradio's client-side controls.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Auth Bypass Inference Framework AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system design and development inputs

NIST AI RMF

MANAGE-2.2 - Risk response — AI risk prioritization and treatment

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-35485?

An unauthenticated path traversal in text-generation-webui prior to v4.3 allows any network-reachable attacker to read arbitrary files from the server filesystem — including API keys, .env files, model configs, and system credentials — by submitting directory traversal payloads (e.g., ../../../etc/passwd) via the Gradio API. The attack requires zero authentication, zero user interaction, and low complexity (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), making it trivially exploitable by anyone who can reach port 7860. Text-generation-webui is one of the most widely deployed open-source LLM frontends in enterprise AI labs and research environments, meaning the blast radius extends to every AI provider API key and credential co-located on the host. Upgrade to v4.3 immediately; if patching is blocked, place the service behind an authenticated reverse proxy and block direct external access.

Is CVE-2026-35485 actively exploited?

No confirmed active exploitation of CVE-2026-35485 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-35485?

1. Patch: Upgrade text-generation-webui to v4.3 or later. No workaround substitutes for the fix. 2. Network isolation: If immediate patching is blocked, restrict access via firewall to trusted IPs only and place behind an authenticated reverse proxy (nginx + OAuth2/Basic Auth). 3. Detection: Search web/application logs for requests containing '../', '%2e%2e%2f', or '%2e%2e/' in any API parameter. Alert on any grammar-related endpoint calls from untrusted sources. 4. Credential rotation: If exposure cannot be ruled out, rotate all API keys, tokens, and passwords stored on the affected host immediately. 5. Audit scope: Inventory all Gradio-based ML UIs in your environment and verify they independently validate file-path inputs server-side, not relying solely on Gradio's client-side controls.

What systems are affected by CVE-2026-35485?

This vulnerability affects the following AI/ML architecture patterns: LLM inference serving, ML UI deployments, local AI development environments, enterprise LLM gateways.

What is the CVSS score for CVE-2026-35485?

CVE-2026-35485 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.68%.

What is the AI security impact?

Affected AI Architectures

LLM inference servingML UI deploymentslocal AI development environmentsenterprise LLM gateways

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in load_grammar() allows reading any file on the server filesystem with no extension restriction. Gradio does not server-side validate dropdown values, so an attacker can POST directory traversal payloads (e.g., ../../../etc/passwd) via the API and receive the full file contents in the response. This vulnerability is fixed in 4.3.

Exploitation Scenario

An attacker enumerates internal AI infrastructure or finds an internet-exposed instance via Shodan (port 7860 is the default Gradio port). They send a POST request to the grammar loader API endpoint, replacing a legitimate grammar filename with a traversal payload such as '../../../home/user/.env' or '../../../opt/aithreatintel/.env'. Gradio forwards the value to load_grammar() without server-side validation; the application opens and reads the file, returning the full contents in the API JSON response. The attacker harvests API keys for OpenAI, Anthropic, and Hugging Face, along with database credentials. They then abuse the exfiltrated AI provider keys to run inference at the victim's expense or access proprietary model data, and use database credentials for further lateral movement into backend systems.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.