CVE-2026-39844: NiceGUI Arbitrary File Write Vulnerability on Windows
Summary
CVE-2026-39844: NiceGUI is a Python-based UI framework. Affects nicegui versions < 3.10.0. Fixed in 3.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
NiceGUI is a Python-based UI framework designed to simplify the creation of user interfaces for applications. It allows developers to build interactive web applications with ease, leveraging Python's capabilities. However, prior to version 3.10.0, NiceGUI had a vulnerability that could lead to arbitrary file write on Windows systems due to improper handling of file path separators.
Vulnerability Detail
The vulnerability arises from the use of PurePosixPath, which only recognizes forward slashes as path separators. This limitation allows an attacker to bypass sanitization by using backslashes in the upload filename on Windows systems. Applications that construct file paths using file.name, as demonstrated in NiceGUI's bundled examples, are particularly susceptible. If exploited, this vulnerability could allow an attacker to write arbitrary files to the server, potentially leading to further exploitation or data compromise.
How To Fix
Latest published version: 3.18.0 as of 22 Oct 2026
pip install --upgrade "nicegui==3.18.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.10.0
This is the first release that contains the fix.
pip install --upgrade "nicegui==3.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application validates and sanitizes file names before processing them. You can implement a check to replace backslashes with forward slashes in the filename, as shown in the following code snippet:
filename = file.name.replace('\', '/')
Conclusion
In summary, CVE-2026-39844 is a significant vulnerability in NiceGUI that allows for arbitrary file writes on Windows systems due to improper path handling. It is crucial to update to version 3.10.0 or later to mitigate this risk. Additionally, employing the suggested workaround can provide temporary relief until an update can be performed.
See every vulnerability recorded for nicegui →
FAQ
The impact includes the potential for arbitrary file writes on Windows systems, which could lead to unauthorized access or data manipulation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Yes, the vulnerability is fixed in NiceGUI version 3.10.0 and later.
If an immediate update is not possible, implement the provided workaround to sanitize file names before processing.
References
Related vulnerabilities
Recent vulnerabilities recorded for nicegui.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
