cvedb.io
CVE-2026-25732
HIGH · CVSS 7.5
EPSS exploitation probability: 0%
Published 2026-02-06T22:16:11.993 · Last modified 2026-06-17T10:25:07.703

Summary

NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames containing ../ sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns. Note: Exploitation requires application code incorporating file.name into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or explicit sanitization are not affected. This vulnerability is fixed i

Affected products

zauberzeug — nicegui

Does this affect you?

Add your gear to cvedb and we'll alert you only when zauberzeug ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.