CVE-2025-66645: NiceGUI Path Traversal Vulnerability Allows Arbitrary File Read
Summary
CVE-2025-66645: NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read. Affects nicegui versions < 3.4.0. Fixed in 3.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NiceGUI is an open-source Python framework designed for building user interfaces with ease. It allows developers to create interactive web applications using Python code. One of its features is the ability to serve media files through the App.add_media_files() method. However, this functionality has a critical vulnerability that can expose sensitive files on the server.
Vulnerability Detail
A directory traversal vulnerability exists in NiceGUI's App.add_media_files() method, which allows remote attackers to read arbitrary files on the server's filesystem. The vulnerability arises because the method does not properly validate the file paths provided by users. Specifically, the {filename:path} parameter permits traversal sequences like '../', enabling attackers to access files outside the designated media directory. This can lead to the exposure of sensitive information, such as application source code, configuration files, and operating system files. The lack of path sanitization or boundary checks exacerbates the issue, making it easy for attackers to exploit this vulnerability.
How To Fix
Latest published version: 3.18.0 as of 22 Oct 2026
pip install --upgrade "nicegui==3.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.0
This is the first release that contains the fix.
pip install --upgrade "nicegui==3.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the App.add_media_files() method to serve files from directories that may contain sensitive information. Instead, consider implementing a custom file-serving mechanism that includes proper path validation and sanitization.
Conclusion
The NiceGUI path traversal vulnerability (CVE-2025-66645) poses a significant risk by allowing unauthorized access to sensitive files on the server. It is crucial for developers using NiceGUI to update to version 3.4.0 or later to mitigate this risk. Additionally, implementing proper file-serving practices can further enhance security.
See every vulnerability recorded for nicegui →
FAQ
The vulnerability is a path traversal issue that allows attackers to read arbitrary files on the server.
If your application uses NiceGUI and calls the App.add_media_files() method, it may be vulnerable. You can check for vulnerabilities using Vulert's playground without any signup.
An attacker could access sensitive files, including application source code, configuration files, and system files, leading to data breaches and security risks.
Yes, the vulnerability has been patched in NiceGUI version 3.4.0. Updating to this version will resolve the issue.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock. You can check if your application is affected by vulnerabilities using their playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for nicegui.
