PT-2026-31353 · Nicegui · Nicegui

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-39844

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions NiceGUI versions prior to 3.10.0

Description NiceGUI, a Python-based UI framework, is susceptible to arbitrary file write on Windows due to insufficient sanitization of uploaded filenames. The PurePosixPath function used for sanitization only recognizes forward slashes (/) as path separators. This allows an attacker to bypass sanitization by using backslashes () in the filename. Applications constructing file paths using file.name are particularly vulnerable. This can lead to arbitrary file write, potential remote code execution through overwriting application files, and data integrity loss.

Recommendations Upgrade to NiceGUI version 3.10.0 or later to resolve this issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-39844

GHSA-W8WV-VFPC-HW2W

Affected Products

Nicegui

References · 6

• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-w8wv-vfpc-hw2w · Vendor Advisory
• https://github.com/zauberzeug/nicegui/commit/d38a702e3af2da5b0708f689be8d71413fc77056 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39844 · Security Note
• https://osv.dev/vulnerability/GHSA-w8wv-vfpc-hw2w · Vendor Advisory
• https://github.com/zauberzeug/nicegui · Note
• https://github.com/zauberzeug/nicegui/releases/tag/v3.10.0 · Note