Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-gk7h-2cu9-2uhm
Vulnerability ID VCID-gk7h-2cu9-2uhm
Aliases CVE-2026-25732
GHSA-9ffm-fxg3-xrhh
PYSEC-2026-95
Summary NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames containing ../ sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns. Note: Exploitation requires application code incorporating file.name into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or explicit sanitization are not affected. This vulnerability is fixed in 3.7.0.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.01382 https://api.first.org/data/v1/epss?cve=CVE-2026-25732
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-9ffm-fxg3-xrhh
cvssv3.1 7.5 https://github.com/zauberzeug/nicegui
generic_textual HIGH https://github.com/zauberzeug/nicegui
cvssv3.1 7.5 https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L110-L115
generic_textual HIGH https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L110-L115
ssvc Track https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L110-L115
cvssv3.1 7.5 https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L79-L82
generic_textual HIGH https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L79-L82
ssvc Track https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L79-L82
cvssv3.1 7.5 https://github.com/zauberzeug/nicegui/security/advisories/GHSA-9ffm-fxg3-xrhh
cvssv3.1_qr HIGH https://github.com/zauberzeug/nicegui/security/advisories/GHSA-9ffm-fxg3-xrhh
generic_textual HIGH https://github.com/zauberzeug/nicegui/security/advisories/GHSA-9ffm-fxg3-xrhh
ssvc Track https://github.com/zauberzeug/nicegui/security/advisories/GHSA-9ffm-fxg3-xrhh
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2026-25732
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-25732
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-25732
https://github.com/zauberzeug/nicegui
https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L110-L115
https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L79-L82
https://github.com/zauberzeug/nicegui/security/advisories/GHSA-9ffm-fxg3-xrhh
CVE-2026-25732 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/52534.py
CVE-2026-25732 https://nvd.nist.gov/vuln/detail/CVE-2026-25732
GHSA-9ffm-fxg3-xrhh https://github.com/advisories/GHSA-9ffm-fxg3-xrhh
Data source Exploit-DB
Date added April 30, 2026
Description NiceGUI 3.6.1 - Path Traversal
Ransomware campaign use Unknown
Source publication date April 30, 2026
Exploit type webapps
Platform multiple
Source update date April 30, 2026
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/zauberzeug/nicegui
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L110-L115
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-09T15:21:57Z/ Found at https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L110-L115
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L79-L82
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-09T15:21:57Z/ Found at https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L79-L82
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/zauberzeug/nicegui/security/advisories/GHSA-9ffm-fxg3-xrhh
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2026-02-09T15:21:57Z/ Found at https://github.com/zauberzeug/nicegui/security/advisories/GHSA-9ffm-fxg3-xrhh
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-25732
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.80612
EPSS Score 0.01382
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:37:11.227991+00:00 Pypa Importer Import https://github.com/pypa/advisory-database/blob/main/vulns/nicegui/PYSEC-2026-95.yaml 38.6.0