NiceGUI 3.6.1 - Path Traversal

ExploitDBExploitDB exploitExploitEDB-52534

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

ExploitDB
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that sends a multipart POST request with a user-supplied malicious filename (containing path traversal sequences) to a NiceGUI target, attempting to write an arbitrary file outside the intended upload directory.

Backdoor review

No backdoor observed in reviewed code

The supplied PoC is a straightforward Python script that demonstrates a path traversal vulnerability in NiceGUI. It reads a local payload file and sends it as a multipart POST request with a user-supplied malicious filename. No backdoor, deceptive payload, or concealed harmful behavior is present.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareNiceGUI
Attack typesPath TraversalArbitrary File Write
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively sends a crafted request containing a path traversal payload to a target server with the intent of writing a file to an arbitrary location. It is not merely checking for the vulnerability; it performs the exploitation action.

exploits/multiple/webapps/52534.py:19-20exploits/multiple/webapps/52534.py:42-44exploits/multiple/webapps/52534.py:52-57

Requirements

  • Target NiceGUI application must use the unsanitized FileUpload.name property in a file save path (e.g., UPLOAD_DIR / file.name).exploits/multiple/webapps/52534.py:20
  • Attacker must provide a target URL, a malicious filename (e.g., '../app.py'), and a local payload file.exploits/multiple/webapps/52534.py:23-24

Observed behavior

  • Reads a local payload file into memory.exploits/multiple/webapps/52534.py:36-37
  • Constructs a multipart file upload request where the filename field is set to the attacker-controlled malicious filename.exploits/multiple/webapps/52534.py:42-44
  • Sends the crafted POST request to the target URL and prints the HTTP response status and a snippet of the response body.exploits/multiple/webapps/52534.py:52-70
  • Prints post-exploitation guidance suggesting checking the target filesystem or waiting for application reload if a critical file was overwritten.exploits/multiple/webapps/52534.py:75-78
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
http://target:8080Example target URL shown in usage docstring; user supplies the actual target.exploits/multiple/webapps/52534.py:23-24
Filename
../etc/passwdExample malicious filename demonstrating path traversal; user controls this argument.exploits/multiple/webapps/52534.py:23
Filename
payload.txtExample local payload file to upload; user controls this argument.exploits/multiple/webapps/52534.py:23
Review boundaries

What the analysis did not establish

  • The script does not verify whether the file was actually written to the target filesystem; it only infers success from the HTTP response code.
  • The script relies on the target application using a specific vulnerable pattern (unsanitized FileUpload.name in a file path), which may not be present in all NiceGUI deployments.
  • Only the supplied text file (52534.py) was reviewed; no external libraries, dependencies, or referenced resources were inspected.
  • The review does not assess whether the target application is actually vulnerable or whether the exploit works as claimed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1