Log in Start free

Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M

CVE-2026-25732NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write

High 7.5

In plain English

A high-severity path traversal in nicegui from zauberzeug. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)3.4%top 11.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames containing ../ sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns. Note: Exploitation requires application code incorporating file.name into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or explicit sanitization are not affected. This vulnerability is fixed in 3.7.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPInicegui3.7.0GHSA-9ffm-fxg3-xrhh
PyPInicegui3.7.0PYSEC-2026-95

Affected products (as reported)

VendorProductVersions
zauberzeug nicegui < 3.7.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References