PT-2025-50275 · Nicegui · Nicegui

Y4Rvin · Published 2025-12-09 · Updated 2025-12-10 · CVE-2025-66645

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NiceGUI versions 3.3.1 and below

Description NiceGUI, a Python-based UI framework, contains a flaw that allows a remote attacker to read arbitrary files on the server filesystem. This is due to a directory traversal issue present in the App.add media files() function. The App.add media files() function does not properly sanitize file paths, allowing an attacker to potentially access sensitive information.

Recommendations Update to version 3.4.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-66645

GHSA-HXP3-63HC-5366

Affected Products

Nicegui

References · 9

• 🔥 https://github.com/zauberzeug/nicegui/security/advisories/GHSA-hxp3-63hc-5366 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66645.json · Exploit
• https://github.com/zauberzeug/nicegui/commit/a1b89e2a24e1911a40389ace2153a37f4eea92a9 · Patch
• https://osv.dev/vulnerability/GHSA-hxp3-63hc-5366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66645 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66645 · Vendor Advisory
• https://github.com/zauberzeug/nicegui · Note
• https://twitter.com/CVEnew/status/1998732779069260155 · Twitter Post
• https://t.me/CVEtracker/39302 · Telegram Post