CVE-2026-25732
published 2026-02-06CVE-2026-25732: NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization…
PriorityP262high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EXPLOIT
EPSS
3.21%
86.6th percentile
NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames containing ../ sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns. Note: Exploitation requires application code incorporating file.name into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or explicit sanitization are not affected. This vulnerability is fixed in 3.7.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zauberzeug | nicegui | < 3.7.0 | 3.7.0 |
| zauberzeug | nicegui | >= 0 < 3.7.0 | 3.7.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect path traversal sequences (e.g., '../' or '..\') in HTTP multipart file upload filename fields targeting NiceGUI endpoints. A malicious client-supplied filename containing '../' sequences in the Content-Disposition header is the primary attack vector. ↗
- →Monitor for unexpected file writes outside the designated upload directory, particularly overwrites of application entry-point files such as app.py or main.py, which could indicate exploitation leading to RCE via application reload. ↗
- →Alert on file upload requests where the filename parameter contains sequences such as '../../' indicating deeper traversal attempts beyond the immediate parent directory. ↗
- →Flag NiceGUI deployments running versions prior to 3.7.0 that use the pattern UPLOAD_DIR / file.name without sanitization, as these are directly exploitable by this vulnerability. ↗
- ·Only NiceGUI applications that directly incorporate the unsanitized FileUpload.name property into filesystem path construction (e.g., UPLOAD_DIR / file.name) are exploitable. Applications using fixed paths, auto-generated filenames, or explicit sanitization of the filename are NOT affected, even on vulnerable versions. ↗
- ·The vulnerability is a design-level 'security footgun' — the framework itself does not sanitize client-supplied filename metadata, placing the burden on developers. Community-promoted patterns (UPLOAD_DIR / file.name) are the prevalent vulnerable pattern to audit for. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
ghsa·2026-02-05
CVE-2026-25732 [HIGH] CWE-22 NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
### Summary
NiceGUI's `FileUpload.name` property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern `UPLOAD_DIR / file.name`. Malicious filenames containing `../` sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns.
**Note**: Exploitation requires application code incorporating `file.name` into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or explicit sani
OSV
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
osv·2026-02-05
CVE-2026-25732 [HIGH] NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
### Summary
NiceGUI's `FileUpload.name` property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern `UPLOAD_DIR / file.name`. Malicious filenames containing `../` sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns.
**Note**: Exploitation requires application code incorporating `file.name` into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or explicit sani
No detection rules found.
2026-02-06
Published