CVE-2026-25732

Summary

NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames containing ../ sequences allow attackers to w

Severity

high

EPSS

3.2% (p87)

Also known as

GHSA-9ffm-fxg3-xrhh, PYSEC-2026-95

Published

2026-02-06

References

• https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L110-L115
• https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L79-L82
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-9ffm-fxg3-xrhh

Related advisories

• CVE-2026-45553 — high · PyPI/nicegui
• CVE-2026-21873 — high · PyPI/nicegui
• CVE-2025-66645 — high · PyPI/nicegui
• CVE-2025-21618 — high · PyPI/nicegui
• CVE-2026-45554 — medium · PyPI/nicegui
• MAL-2026-3180 — medium · npm/nicegui
• CVE-2026-39844 — medium · PyPI/nicegui
• CVE-2026-33332 — medium · PyPI/nicegui

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity