Path Traversal Vulnerability in NiceGUI Python UI Framework

CVE-2026-39844

What is CVE-2026-39844?

NiceGUI, a Python-based UI framework, is vulnerable to a path traversal issue where an attacker can bypass sanitization controls on Windows by using backslashes in the upload filename. Specifically, the vulnerability arises from the use of PurePosixPath which only recognizes forward slashes as path separators. Applications built with NiceGUI, particularly those that construct file paths using file.name as shown in NiceGUI's bundled examples, may allow for arbitrary file writes on Windows systems. This issue has been resolved in version 3.10.0.

References