CVE-2025-66645
High · 7.5CVSS
7.5
EPSS
1.1%
Published
Dec 9, 2025
CISA due date
—
The record
NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | nicegui | 0 | 3.4.0 |
Related vulnerabilities
- GHSA-hxp3-63hc-5366 NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read Same vulnerability
- GHSA-78qv-3mpx-9cqq NiceGUI vulnerable to XSS via Code Injection during client-side element function execution Also affects nicegui
- CVE-2026-27156 NiceGUI is a Python-based UI framework. Also affects nicegui
- CVE-2026-25732 NiceGUI is a Python-based UI framework. Also affects nicegui
- CVE-2026-25516 NiceGUI is a Python-based UI framework. Also affects nicegui
- GHSA-9ffm-fxg3-xrhh NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write Also affects nicegui
- GHSA-v82v-c5x8-w282 NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution… Also affects nicegui
- GHSA-mp55-g7pj-rvm2 NiceGUI has Redis connection leak via tab storage causes service degradation Also affects nicegui