CVE-2026-39844: NiceGUI Path Traversal Vulnerability via Filename Sanitization Bypass
Summary
CVE-2026-39844: NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows. Affects nicegui versions < 3.10.0. Fixed in 3.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
NiceGUI is an open-source Python library designed for building user interfaces for web applications. It simplifies the process of creating interactive web applications by providing a set of high-level components and tools. However, a vulnerability has been identified in its file upload functionality, which allows for path traversal attacks on Windows systems.
Vulnerability Detail
The vulnerability arises from inadequate filename sanitization in NiceGUI's file upload feature. Specifically, the use of PurePosixPath(filename).name fails to properly handle backslashes, which are treated as literal characters rather than path separators on Windows. This allows an attacker to bypass the intended sanitization, leading to potential arbitrary file writes outside the designated upload directory. The consequences include the risk of remote code execution, data integrity loss, and overwriting critical application files.
How To Fix
Latest published version: 3.18.0 as of 22 Oct 2026
pip install --upgrade "nicegui==3.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.10.0
This is the first release that contains the fix.
pip install --upgrade "nicegui==3.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can manually validate and sanitize filenames before processing uploads. For example, you can implement a check to ensure that filenames do not contain backslashes or other potentially harmful characters. Here is a sample code snippet to illustrate this:
import re
def sanitize_filename(filename):
# Remove backslashes and any other unwanted characters
return re.sub(r'[\\]', '', filename)
# Usage
safe_filename = sanitize_filename(upload.filename)
Conclusion
In summary, CVE-2026-39844 presents a significant risk for applications using NiceGUI on Windows due to a path traversal vulnerability stemming from improper filename sanitization. It is crucial to update to the latest version or implement a workaround to ensure the security of your application.
See every vulnerability recorded for nicegui →
FAQ
CVE-2026-39844 is a vulnerability in the NiceGUI package that allows for path traversal attacks due to improper filename sanitization on Windows systems.
If your application uses NiceGUI for file uploads on Windows, it may be susceptible to arbitrary file writes, which can lead to data loss or remote code execution.
You can implement a manual filename sanitization process as a temporary workaround until you can update to the patched version.
No, this vulnerability specifically affects Windows systems due to the way backslashes are handled in file paths.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application without signup using the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for nicegui.
