CVE-2026-25732
Unknown Unknown - Not Provided
Path Traversal in NiceGUI FileUpload.name Enables Remote Code Execution

Publication date: 2026-02-06

Last updated on: 2026-02-20

Assigner: GitHub, Inc.

Description
NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames containing ../ sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns. Note: Exploitation requires application code incorporating file.name into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or explicit sanitization are not affected. This vulnerability is fixed in 3.7.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-06
Last Modified
2026-02-20
Generated
2026-06-16
AI Q&A
2026-02-07
EPSS Evaluated
2026-06-15
NVD
CVE-2026-25732
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
zauberzeug nicegui to 3.7.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability exists in NiceGUI, a Python-based UI framework, in versions prior to 3.7.0. The FileUpload.name property exposes client-supplied filename metadata without sanitization. This allows attackers to use path traversal sequences like ../ in filenames to write files outside the intended upload directory.

If developers use the pattern UPLOAD_DIR / file.name without sanitizing the filename, malicious files can overwrite arbitrary files on the server. This can lead to remote code execution if critical application files are overwritten.

The vulnerability only affects applications that incorporate the unsanitized file.name into filesystem paths. Applications using fixed paths, generated filenames, or explicit sanitization are not affected. The issue is fixed in NiceGUI version 3.7.0.

Impact Analysis

This vulnerability can allow attackers to perform path traversal attacks by uploading files with specially crafted filenames containing ../ sequences.

As a result, attackers may write files outside the intended upload directory, potentially overwriting important application files.

This can lead to remote code execution, allowing attackers to execute arbitrary code on the server, compromising the application's integrity and security.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, upgrade NiceGUI to version 3.7.0 or later where the issue is fixed.

Additionally, ensure that your application code does not incorporate client-supplied filenames directly into filesystem paths without proper sanitization.

Use fixed paths, generated filenames, or explicitly sanitize filenames to prevent path traversal attacks.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25732. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart