CVE-2026-45553
HIGHNiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
Title source: cnaDescription
NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reStructuredText server-side with Docutils without disabling file insertion directives. When a NiceGUI application passes attacker-controlled content to ui.restructured_text(), an attacker can use standard Docutils directives (include, csv-table with :file:, raw with :file:) to read local files readable by the NiceGUI server process. Applications that only pass trusted static strings to ui.restructured_text() are not affected. This issue has been patched in version 3.12.0.
References (2)
Core 2
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/zauberzeug/nicegui/security/advisories/GHSA-jfrm-rx66-g536
X_Refsource_Misc x_refsource_misc
https://github.com/zauberzeug/nicegui/releases/tag/v3.12.0
Scores
CVSS v3
7.5
EPSS
0.0026
EPSS Percentile
16.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-200
Status
published
Products (2)
pypi/nicegui
0 - 3.12.0PyPI
zauberzeug/nicegui
< 3.12.0
Published
Jun 02, 2026
Tracked Since
Jun 02, 2026