No security policy detected

This project has not set up a SECURITY.md file yet.

• Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path.

  GHSA-r2qq-p5wg-gf5g published Apr 3, 2026 by oobabooga

  High
• CWE-22 Path Traversal in load_preset() — .yaml file read without authentication

  GHSA-w3cv-4447-5hf5 published Apr 3, 2026 by oobabooga

  Moderate
• CWE-22 Path Traversal in load_grammar() — arbitrary file read without authentication

  GHSA-hqg5-487v-5mc6 published Apr 3, 2026 by oobabooga

  High
• CWE-918 SSRF in superbooga/superboogav2 extensions — no URL validation

  GHSA-jvrj-w5hq-6cp2 published Apr 3, 2026 by oobabooga

  High
• CWE-22 Path Traversal in load_template() — .jinja/.yaml/.yml file read without authentication

  GHSA-85fx-vw25-4c95 published Apr 3, 2026 by oobabooga

  Moderate
• CWE-22 Path Traversal in load_prompt() — .txt file read without authentication

  GHSA-mfgg-vvc6-vqq7 published Apr 3, 2026 by oobabooga

  Moderate
• SSRF via OpenAI multimodal image_url fetch in text-generation-webui

  GHSA-fpwc-4mvr-7jpr published Mar 18, 2026 by oobabooga

  High
• Arbitrary File Write/Delete via Path Traversal in Character Name

  GHSA-4p45-76cc-7p62 published Mar 18, 2026 by oobabooga

  Critical
• Remote Code Execution (RCE) through Path Traversal at "Session -> Save extention settings to user_data/settings.yaml".

  GHSA-jg96-p5p6-q3cv published Mar 18, 2026 by oobabooga

  Critical
• text-generation-webui allows arbitrary file read via symbolic link upload

  GHSA-66rw-q8w5-c2hg published Oct 13, 2025 by oobabooga

  High