Directory Traversal Vulnerability in NiceGUI Framework by Zauberzeug
CVE-2025-66645

7.5HIGH

Key Information:

Vendor

Zauberzeug

Status
Nicegui
Vendor
CVE Published:
9 December 2025

What is CVE-2025-66645?

The NiceGUI framework, which is based on Python, has a vulnerability that allows attackers to exploit directory traversal through the App.add_media_files() function. This weakness lets unauthorized users read arbitrary files from the server's filesystem, potentially exposing sensitive information. The issue has been addressed in version 3.4.0, which users are encouraged to update to promptly. For more details on the vulnerability and its resolution, refer to the official advisories.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

nicegui < 3.4.0

References

https://github.com/zauberzeug/nicegui/security/advisories...
x_refsource_CONFIRM
https://github.com/zauberzeug/nicegui/commit/a1b89e2a24e1...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.