CVE-2026-39844
published 2026-04-08CVE-2026-39844: NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass…
PriorityP348high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.37%
28.9th percentile
NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\) in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zauberzeug | nicegui | < 3.10.0 | 3.10.0 |
| zauberzeug | nicegui | >= 0 < 3.10.0 | 3.10.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
osv·2026-04-08
CVE-2026-39844 [MEDIUM] NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
### Summary
The upload filename sanitization introduced in GHSA-9ffm-fxg3-xrhh uses `PurePosixPath(filename).name` to strip path components. Since `PurePosixPath` only recognizes forward slashes (`/`) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (`\`) in the upload filename.
Applications that construct file paths using `file.name` (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows.
### Details
The sanitization in `nicegui/elements/upload_files.py` uses:
```python
filename = PurePosixPath(upload.filename or '').name
```
`PurePosixPath` treats backslashes as literal characters, not path separ
GHSA
NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
ghsa·2026-04-08
CVE-2026-39844 [MEDIUM] CWE-22 NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
### Summary
The upload filename sanitization introduced in GHSA-9ffm-fxg3-xrhh uses `PurePosixPath(filename).name` to strip path components. Since `PurePosixPath` only recognizes forward slashes (`/`) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (`\`) in the upload filename.
Applications that construct file paths using `file.name` (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows.
### Details
The sanitization in `nicegui/elements/upload_files.py` uses:
```python
filename = PurePosixPath(upload.filename or '').name
```
`PurePosixPath` treats backslashes as literal characters, not path separ
No detection rules found.
No public exploits indexed.
2026-04-08
Published