Abidlabs

**Name of the Vulnerable Software and Affected Versions** Gradio versions prior to 6.16.0 **Description** A path traversal issue exists in the `preprocess()` function of the FileExplorer component. Unauthenticated attackers can escape the configured root directory by providing path segments that include absolute paths or directory traversal sequences. This occurs because the `os.path.join` function may discard the `root dir` prefix when processing these crafted segments, leading to arbitrary file read or the exposure of sensitive files located outside the intended directory. **Recommendations** Update Gradio to version 6.16.0 or later.