Path Traversal Vulnerability in NiceGUI Framework by Zauberzeug

CVE-2026-25732

What is CVE-2026-25732?

The NiceGUI framework, which is utilized for building user interfaces in Python, has a vulnerability in its FileUpload component. Specifically, the name property of the FileUpload exposes client-supplied filename metadata without appropriate sanitization. This oversight can lead to path traversal attacks if developers use the pattern UPLOAD_DIR / file.name, allowing attackers to manipulate filenames using sequences like '../'. This flaw enables writing files outside designated directories, creating opportunities for remote code execution through file overwrites in certain deployment scenarios. Applications that incorporate filename metadata directly into file system paths without any form of validation are particularly susceptible. However, those utilizing fixed file paths or applying explicit sanitation measures remain unaffected. This vulnerability has been addressed in version 3.7.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References