Description
Gradio /static//windows/win.ini 文件读取漏洞，未经身份验证攻击者可通过该漏洞读取系统重要文件（如数据库配置文件、系统配置文件）、数据库配置文件等等，导致网站处于极度不安全状态。
Gradio /static//windows/win.ini 文件读取漏洞 （CVE-2026-28414）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2026-28414
https://github.com/gradio-app/gradio/security/advisories/GHSA-39mp-8hj3-5c49
https://www.linkedin.com/posts/horizon3ai_our-research-team-discovered-an-unauthenticated-activity-7434359262492942336-p3Ax
https://horizon3.ai/attack-research/disclosures/exploiting-file-read-vulnerabilities-in-gradio-to-steal-secrets-from-hugging-face-spaces/
https://advisories.gitlab.com/pkg/pypi/gradio/CVE-2026-28414/
https://strobes.co/vi/cve/CVE-2026-28414/
https://www.miggo.io/vulnerability-database/cve/CVE-2026-28414
https://www.codeant.ai/vulnerability-database/cve-2026-28414
https://pentest-tools.com/vulnerabilities-exploits/gradio-absolute-path-traversal_29094
https://bitninja.com/blog/understanding-cve-2026-28414-protect-your-server-now/