Executive brief
NiceGUI is a Python framework used to build web-based user interfaces. A security flaw in how the framework handles file uploads on Windows systems allows an attacker to bypass safety checks by using backslashes in filenames. This could allow a remote attacker to write or overwrite files anywhere on the server's hard drive, potentially leading to a complete system takeover or data loss.
Technical details
A path traversal vulnerability exists in NiceGUI's file upload component when running on Windows. The framework used 'PurePosixPath' to sanitize filenames, which only recognizes forward slashes (/) as directory separators. On Windows, backslashes (\) are also valid separators; an attacker can provide a filename containing backslashes (e.g., '..\..\shell.exe') to bypass the 'PurePosixPath.name' filter. If the application uses the resulting 'file.name' to construct a storage path, it can result in arbitrary file write outside the intended directory. This issue is fixed in version 3.10.0 by explicitly splitting on both slash types.
Affected products
- zauberzeug NiceGUI < 3.10.0
Timeline
- 2026-04-07: patched: Fixed in version 3.10.0
- 2026-04-07: advisory: GitHub Security Advisory GHSA-w8wv-vfpc-hw2w published
- 2026-04-08: disclosed: CVE-2026-39844 published to NVD