CVE-2026-49119 is a path traversal vulnerability in gradio-app's gradio product affecting versions before 6.16.0. The vulnerability exists in the FileExplorer component's preprocess() method, where improper handling of path segments allows attackers to bypass directory restrictions. By supplying specially crafted path segments containing directory traversal sequences or absolute paths, attackers can manipulate os.path.join to discard the root_dir prefix, enabling unauthorized access to files outside the designated root directory. This vulnerability requires no authentication and has a CVSS 4.0 score of 8.7, indicating high severity.

An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the system outside the intended root directory. This may lead to exposure of sensitive information or configuration files, potentially compromising confidentiality. There is no indication of privilege escalation, integrity, or availability impact in the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable component and monitor for suspicious activity related to file access. Avoid exposing the FileExplorer component to untrusted users. Follow vendor updates closely for an official fix or temporary mitigation.