CVE-2026-39844
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
NiceGUI, a Python-based UI framework, prior to version 3.10.0 is vulnerable to arbitrary file write on Windows. Because PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass sanitization by using backslashes (\) in the upload filename.
Risk Assessment
An attacker can overwrite arbitrary files on the Windows server, potentially leading to remote code execution or full system compromise.
Recommendation
Upgrade NiceGUI to version 3.10.0 or later.
Other vulnerabilities in NiceGUI
See all- CVE-2026-21873High
NiceGUI versions 2.22.0 to 3.4.1 have an unsafe implementation in the pushstate event listener used by ui.sub_pages, allowing an attacker to manipulate the fragment identifier of the URL, even cross-site, using an iframe. This issue has been patched in version 3.5.0.
- CVE-2026-45554Medium
NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. This issue has been patched in version 3.12.0.
- CVE-2026-45553High
NiceGUI prior to version 3.12.0 has a vulnerability in ui.restructured_text() that renders reStructuredText server-side without disabling file insertion directives. An attacker can read local files accessible to the NiceGUI server process.
Original NVD description (English source)
NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\) in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS