medium5.9
CVE-2026-39844
NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
Impact
NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\) in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | nicegui | <= 3.9.0 | 3.10.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zauberzeug | Nicegui | before 3.10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-w8wv-vfpc-hw2w
- https://github.com/zauberzeug/nicegui/security/advisories/GHSA-w8wv-vfpc-hw2w
- https://github.com/zauberzeug/nicegui/commit/d38a702e3af2da5b0708f689be8d71413fc77056
- https://github.com/zauberzeug/nicegui/releases/tag/v3.10.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-39844