Skip to content
OpenAdvisories
Medium · 5.9 CVE-2026-39844 EUVD-2026-20610GHSA-w8wv-vfpc-hw2wPYSEC-2026-2234

NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization

Published Apr 8, 2026 · Updated Apr 9, 2026 · Assigned by GitHub_M

Description

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\) in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.

Affected products

VendorProductAffectedFixed
zauberzeug nicegui < 3.10.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI nicegui < 3.10.0 3.10.0 GHSA-w8wv-vfpc-hw2w

References