CVE-2026-39844
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
NiceGUI, a Python-based UI framework, prior to version 3.10.0 is vulnerable to arbitrary file write on Windows. Because PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass sanitization by using backslashes (\) in the upload filename.
Risk Assessment
An attacker can overwrite arbitrary files on the Windows server, potentially leading to remote code execution or full system compromise.
Recommendation
Upgrade NiceGUI to version 3.10.0 or later.
Original NVD description (English source)
NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\) in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.