CVE-2026-25732
HIGHNiceGUI < 3.7.0 - Path Traversal via FileUpload.name Property
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2026-25732. PoCs published by banyamer, XiaomingX, mbanyamer.
AI-analyzed exploit summary This exploit demonstrates a path traversal vulnerability in NiceGUI <= 3.6.1, allowing arbitrary file write by manipulating the filename in a multipart file upload. The PoC sends a crafted POST request with a malicious filename to overwrite files on the target system.
Description
NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern UPLOAD_DIR / file.name. Malicious filenames containing ../ sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns. Note: Exploitation requires application code incorporating file.name into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or explicit sanitization are not affected. This vulnerability is fixed in 3.7.0.
Exploits (3)
This exploit demonstrates a path traversal vulnerability in NiceGUI <= 3.6.1, allowing arbitrary file write by manipulating the filename in a multipart file upload. The PoC sends a crafted POST request with a malicious filename to overwrite files on the target system.
The repository contains a functional exploit for CVE-2026-25732, which leverages a path traversal vulnerability in NiceGUI's FileUpload component to achieve arbitrary file write. The exploit sends a crafted multipart POST request with a malicious filename to overwrite files on the target system.
This exploit demonstrates a path traversal vulnerability in NiceGUI's FileUpload feature, allowing arbitrary file writes by manipulating the filename field. It sends a crafted multipart POST request to upload a file with a traversal sequence in its name.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N