Executive brief
NiceGUI is a Python framework used to build web-based user interfaces. A vulnerability in its file upload component allows attackers to bypass intended storage folders and write files to arbitrary locations on the server. This could allow an attacker to overwrite critical application files, potentially leading to full system takeover or service disruption.
Technical details
A path traversal vulnerability exists in NiceGUI's `SmallFileUpload.save()` and `LargeFileUpload.save()` methods within `nicegui/elements/upload_files.py`. The `FileUpload.name` property contains unsanitized client-supplied metadata, including directory traversal sequences like `../`. When application code constructs a filesystem path using this property (e.g., `UPLOAD_DIR / e.file.name`), an attacker can specify an absolute path or a relative path that escapes the intended directory. This allows for arbitrary file writes and potential remote code execution (RCE) if the attacker overwrites application source code or configuration files. The issue is addressed in version 3.7.0.
Affected products
- zauberzeug nicegui <= 3.6.1
Timeline
- 2026-02-05: disclosed
- 2026-02-05: advisory
- 2026-02-05: patched: Fixed in version 3.7.0