Is CVE-2026-39844 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39844 being exploited in the wild.

How severe is CVE-2026-39844?

Medium severity, with a CVSS score of 5.9, published 8 April 2026.

Which products and versions are affected?

nicegui (PyPI) ECOSYSTEM:introduced=0,fixed=3.10.0.

Is there a fix for CVE-2026-39844?

Yes. nicegui (PyPI): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39844 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-39844?

Check whether you run Microsoft Windows or nicegui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39844: Zauberzeug NiceGUI path traversal in file upload on Windows

CVE-2026-39844 · Severity: medium · CVSS 5.9 · Published 2026-04-08

NiceGUI is a Python framework used to build web-based user interfaces. A security flaw in how the framework handles file uploads on Windows systems allows an attacker to bypass safety checks by using backslashes in filenames. This could allow a remote attacker to write or overwrite files anywhere on the server's hard drive, potentially leading to a complete system takeover or data loss.

Technologies: Microsoft Windows, nicegui (PyPI). Vendors: Microsoft, PyPI.

Quick answers

Is CVE-2026-39844 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39844 being exploited in the wild.
How severe is CVE-2026-39844?: Medium severity, with a CVSS score of 5.9, published 8 April 2026.
Which products and versions are affected?: nicegui (PyPI) ECOSYSTEM:introduced=0,fixed=3.10.0.
Is there a fix for CVE-2026-39844?: Yes. nicegui (PyPI): upgrade to 3.10.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39844 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-39844?: Check whether you run Microsoft Windows or nicegui (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

nicegui (PyPI): upgrade to 3.10.0 or later
```
pip install "nicegui>=3.10.0"
```

Technical details

A path traversal vulnerability exists in NiceGUI's file upload component when running on Windows. The framework used 'PurePosixPath' to sanitize filenames, which only recognizes forward slashes (/) as directory separators. On Windows, backslashes (\) are also valid separators; an attacker can provide a filename containing backslashes (e.g., '..\..\shell.exe') to bypass the 'PurePosixPath.name' filter. If the application uses the resulting 'file.name' to construct a storage path, it can result in arbitrary file write outside the intended directory. This issue is fixed in version 3.10.0 by explicitly splitting on both slash types.

Affected products

zauberzeug NiceGUI < 3.10.0

Identifiers

CVE-2026-39844
GHSA-w8wv-vfpc-hw2w
PYSEC-2026-2234

Timeline

2026-04-07: patched: Fixed in version 3.10.0
2026-04-07: advisory: GitHub Security Advisory GHSA-w8wv-vfpc-hw2w published
2026-04-08: disclosed: CVE-2026-39844 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.