Directory traversal vulnerability in NiceGUI's file handling routes

CVE-2026-45554

What is CVE-2026-45554?

NiceGUI, a Python-based UI framework, contains a vulnerability in its FastAPI routes that serve static assets. Prior to version 3.12.0, these routes accept a sub-path parameter that can resolve to a directory instead of a file, leading to an unhandled RuntimeError during a request. This unhandled error is logged by Uvicorn, resulting in a flood of log entries which could overwhelm the server's disk and log pipeline capacity. Since these routes do not require authentication, a remote attacker could exploit this flaw to degrade the performance of publicly accessible NiceGUI applications. The issue has been addressed in version 3.12.0.

References