CVE-2024-32005 Local File Inclusion in NiceGUI leaflet component
An attacker can read arbitrary files on the backend filesystem via a local file inclusion vulnerability in the NiceGUI leaflet component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-32005?
CVE-2024-32005 is a high-severity path traversal vulnerability in zauberzeug nicegui, published on 12 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. As a result any file on the backend filesystem which the web server has access to can be read by an attacker with access to the NiceUI leaflet website. This vulnerability has been addressed in version 1.4.21. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2024-32005?
3 open source packages ship an affected version, including nicegui.
| Package | Affected | Fixed in |
|---|---|---|
nicegui PyPI | From 1.4.6 | 1.4.21 |
nicegui PyPI | From 1.4.6 | 1.4.21 |
nicegui PyPI | From 1.4.6 | 1.4.21 |
How do I fix CVE-2024-32005?
Upgrade nicegui to 1.4.21 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-32005 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-32005 exists.
Sources
Also known as GHSA-mwc7-64wg-pgvj, PYSEC-2026-1704.