CVE-2026-25732 NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write
Attackers can write arbitrary files outside intended directories via unsanitized filenames in NiceGUI, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25732?
CVE-2026-25732 is a high-severity path traversal vulnerability in zauberzeug nicegui, published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames containing ../ sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns. Note: Exploitation requires application code incorporating file.name into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or explicit sanitization are not affected. This vulnerability is fixed in 3.7.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-25732?
3 open source packages ship an affected version, including nicegui. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nicegui PyPI | All versions | 3.7.0 |
nicegui PyPI | All versions | 3.7.0 |
nicegui PyPI | All versions | 3.7.0 |
Products include Zauberzeug Nicegui.
How do I fix CVE-2026-25732?
Upgrade nicegui to 3.7.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-25732 being exploited?
There is no known exploitation of CVE-2026-25732 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in zauberzeug nicegui
- CVE-2025-66645 NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading
- CVE-2026-21873 Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages`
- CVE-2026-33332 NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
- CVE-2026-27156 NiceGUI has XSS via Code Injection
- CVE-2026-25516 NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
Sources
Also known as GHSA-9ffm-fxg3-xrhh, PYSEC-2026-95.