CVE-2026-25732: NiceGUI Path Traversal Vulnerability via Unsanitized File Upload
Summary
CVE-2026-25732: NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write. Affects nicegui versions < 3.7.0. Fixed in 3.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NiceGUI is a Python framework designed for building user interfaces with ease. It allows developers to create web applications quickly, utilizing a simple and intuitive API. However, a significant vulnerability exists in its file upload functionality, specifically in how it handles user-supplied filenames. This flaw can lead to serious security risks, including unauthorized file access and potential remote code execution.
Vulnerability Detail
The vulnerability arises from the FileUpload.name property in NiceGUI, which exposes client-supplied filenames without proper sanitization. When developers use this filename directly in file paths, it allows attackers to exploit path traversal techniques by including sequences like '../' in the filename. This can lead to writing files outside the intended upload directory, potentially overwriting critical application files and executing arbitrary code upon application restart. The affected methods, SmallFileUpload.save() and LargeFileUpload.save(), do not validate the provided path, making this vulnerability particularly dangerous.
How To Fix
Latest published version: 3.18.0 as of 22 Oct 2026
pip install --upgrade "nicegui==3.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.7.0
This is the first release that contains the fix.
pip install --upgrade "nicegui==3.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can sanitize the filename before saving it. Here is an example code snippet to implement this:
async def handle_upload(e): safe_name = Path(e.file.name).name # Strip directory components!
await e.file.save(UPLOAD_DIR / safe_name)
Conclusion
In summary, the NiceGUI path traversal vulnerability (CVE-2026-25732) poses a significant risk to applications that utilize its file upload functionality without proper filename sanitization. By updating to version 3.7.0 or later and implementing the suggested workaround, developers can protect their applications from potential exploitation.
See every vulnerability recorded for nicegui →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can allow attackers to write files to any location writable by the application process, potentially leading to remote code execution, overwriting configuration files, and persistent access through malicious file uploads.
Yes, you can prevent this vulnerability by sanitizing user-supplied filenames before using them in file paths, ensuring that only safe filenames are processed.
If an immediate update is not possible, implement the provided workaround to sanitize filenames and mitigate the risk until you can upgrade to the patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for nicegui.
