CVE-2026-25732

The record

NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames containing ../ sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns. Note: Exploitation requires application code incorporating file.name into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or explicit sanitization are not affected. This vulnerability is fixed in 3.7.0.

Affected packages

Related vulnerabilities

• GHSA-9ffm-fxg3-xrhh NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write Same vulnerability
• GHSA-78qv-3mpx-9cqq NiceGUI vulnerable to XSS via Code Injection during client-side element function execution Also affects nicegui
• CVE-2026-27156 NiceGUI is a Python-based UI framework. Also affects nicegui
• CVE-2026-25516 NiceGUI is a Python-based UI framework. Also affects nicegui
• GHSA-v82v-c5x8-w282 NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution… Also affects nicegui
• GHSA-mp55-g7pj-rvm2 NiceGUI has Redis connection leak via tab storage causes service degradation Also affects nicegui
• GHSA-mhpg-c27v-6mxr NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS Also affects nicegui
• GHSA-m7j5-rq9j-6jj9 NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary… Also affects nicegui