CVE-2026-25732: NiceGUI Path Traversal Vulnerability

CVE-2026-25732 Overview

A path traversal vulnerability has been identified in NiceGUI, a Python-based UI framework, affecting versions prior to 3.7.0. The vulnerability exists in NiceGUI's FileUpload.name property, which exposes client-supplied filename metadata without proper sanitization. When developers use the common pattern UPLOAD_DIR / file.name to construct file paths, malicious filenames containing ../ sequences can allow attackers to write files outside the intended upload directories.

Critical Impact

This vulnerability enables attackers to write arbitrary files to locations outside the designated upload directory, potentially leading to remote code execution through application file overwrites in vulnerable deployment patterns.

Affected Products

• NiceGUI versions prior to 3.7.0
• Applications using the FileUpload.name property in filesystem path construction without sanitization
• Python web applications following common community upload patterns

Discovery Timeline

• 2026-02-06 - CVE CVE-2026-25732 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-25732

Vulnerability Analysis

This path traversal vulnerability (CWE-22) arises from a design flaw in the NiceGUI framework's file upload handling mechanism. The FileUpload.name property directly returns the client-supplied filename without any sanitization or validation. When developers concatenate this unsanitized filename with a base upload directory path, attackers can manipulate the filename to include directory traversal sequences.

The vulnerability has been characterized as a "security footgun" affecting applications that follow common community patterns for file upload handling. It's important to note that exploitation requires the application code to incorporate file.name into filesystem paths without implementing its own sanitization. Applications that use fixed paths, generate filenames server-side, or implement explicit sanitization measures are not affected by this vulnerability.

Root Cause

The root cause lies in the framework's decision to expose raw, client-controlled filename metadata through the FileUpload.name property without performing any sanitization. The vulnerable code can be found in the upload_files.py module and the related upload handling code. This design choice places the burden of input validation entirely on application developers, many of whom follow community examples that do not include proper filename sanitization.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft a malicious file upload request containing specially crafted filename metadata. By including directory traversal sequences such as ../ in the filename, the attacker can escape the intended upload directory and write files to arbitrary locations on the filesystem, limited only by the application's write permissions.

For example, a malicious filename like ../../../etc/cron.d/malicious_job or ../app/main.py could be used to overwrite critical system files or application code, potentially leading to remote code execution. The success of such attacks depends on the specific deployment pattern and file system permissions of the target application.

For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-25732

Indicators of Compromise

• File upload requests containing ../ or encoded path traversal sequences in filenames
• Unexpected files appearing outside designated upload directories
• Modified application files or configuration files with recent timestamps correlating to upload events
• Web server logs showing suspicious filenames in multipart form data

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in file upload requests
• Monitor file system integrity for unexpected modifications in application directories
• Review application logs for upload requests with filenames containing suspicious characters or sequences
• Deploy runtime application self-protection (RASP) solutions to detect path manipulation attempts

Monitoring Recommendations

• Configure file integrity monitoring (FIM) on critical application directories and configuration files
• Set up alerting for file creation events outside designated upload directories
• Monitor web server access logs for anomalous file upload patterns
• Implement audit logging for all file upload operations with full filename capture

How to Mitigate CVE-2026-25732

Immediate Actions Required

• Upgrade NiceGUI to version 3.7.0 or later immediately
• Audit existing application code for usage of the FileUpload.name property in filesystem path construction
• Implement server-side filename sanitization or use generated filenames until the upgrade is complete
• Review recently uploaded files for evidence of exploitation attempts

Patch Information

The vulnerability has been addressed in NiceGUI version 3.7.0. Organizations should upgrade to this version or later to receive the security fix. The patch ensures proper sanitization of client-supplied filenames before they are exposed through the FileUpload.name property. Detailed information about the fix is available in the GitHub Security Advisory.

Workarounds

• Replace direct usage of file.name with server-generated filenames using UUID or similar random identifiers
• Implement explicit filename sanitization by stripping path separators and directory traversal sequences
• Use os.path.basename() on any client-supplied filename before path construction
• Validate that the final resolved path remains within the intended upload directory using os.path.realpath() comparison

# Example: Upgrading NiceGUI to the patched version
pip install --upgrade nicegui>=3.7.0

# Verify installed version
pip show nicegui | grep Version