Skip to content
OpenAdvisories

Package · PyPI

nicegui

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-25732 Public exploit

    NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write

    NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames cont…

    zauberzeug nicegui nicegui PyPI
  • High 7.5
    CVE-2025-66645 Public exploit

    NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading

    NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version …

    zauberzeug nicegui nicegui PyPI
  • Medium 6.1
    CVE-2025-66470 Public exploit

    NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

    NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactive_image component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows att…

    zauberzeug nicegui nicegui PyPI