Security Advisory

CVE-2026-39844

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-04-08 20:13:31

Last updated 2026-04-09 16:17:11

Assigner GitHub_M

CVSS score 5.9

State PUBLISHED

Description

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\) in the upload filename. Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.

← Browse all CVEs View on cve.org ↗