CVE-2026-39844

Published: Apr 8, 2026Modified: Jul 24, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\) in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.

Affected (1)

Products: Zauberzeug: Nicegui

1 product

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Zauberzeug Nicegui	Before 3.10.0

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (3)

https://github.com/zauberzeug/nicegui/commit/d38a702e3af2da5b0708f689be8d71413fc77056

Source: security-advisories@github.com

Patch

https://github.com/zauberzeug/nicegui/releases/tag/v3.10.0

Source: security-advisories@github.com

Release Notes

https://github.com/zauberzeug/nicegui/security/advisories/GHSA-w8wv-vfpc-hw2w

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.