CVE-2026-39844 NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization

What is CVE-2026-39844?

CVE-2026-39844 is a medium-severity path traversal vulnerability in zauberzeug nicegui, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\) in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.

Weakness: CWE-22

Which versions are affected by CVE-2026-39844?

3 open source packages ship an affected version, including nicegui. It affects 1 product.

Products include Zauberzeug Nicegui.

How do I fix CVE-2026-39844?

Upgrade nicegui to 3.10.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-39844 being exploited?

There is no known exploitation of CVE-2026-39844 in the wild and no public exploit code.

Other vulnerabilities in zauberzeug nicegui

• CVE-2026-25732 NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write High 7.5
• CVE-2025-66645 NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading High 7.5
• CVE-2026-21873 Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages` High 7.2
• CVE-2026-33332 NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion Medium 6.9
• CVE-2026-27156 NiceGUI has XSS via Code Injection Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w8wv-vfpc-hw2w, PYSEC-2026-2234.