Arbitrary file disclosure via unvalidated component post-processing

Data validation flaws in Gradio before 5.0 allow remote attackers to read arbitrary server files through crafted component requests. Post-processing in FileData-related components converts attacker-controlled paths or dictionaries without enforcing expected input constraints, while Code directly reads a supplied path. Exploitation requires an application to expose an affected component and a request path that reaches its processing hook; successful attacks disclose files readable by the server process without modifying them.