{"id":"CVE-2026-39844","aliases":["GHSA-w8wv-vfpc-hw2w","PYSEC-2026-2234"],"url":"https://o3.security/vulnerability/CVE-2026-39844","summary":"NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization","details":"### Summary\n\nThe upload filename sanitization introduced in GHSA-9ffm-fxg3-xrhh uses `PurePosixPath(filename).name` to strip path components. Since `PurePosixPath` only recognizes forward slashes (`/`) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (`\\`) in the upload filename.\n\nApplications that construct file paths using `file.name` (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows.\n\n### Details\n\nThe sanitization in `nicegui/elements/upload_files.py` uses:\n\n```python\nfilename = PurePosixPath(upload.filename or '').name\n```\n\n`PurePosixPath` treats backslashes as literal characters, not path separators:\n\n```python\n>>> PurePosixPath('..\\\\..\\\\secret\\\\evil.txt').name\n'..\\\\..\\\\secret\\\\evil.txt'  # Not stripped!\n```\n\nWhen this filename is used in a path operation on Windows (e.g., `Path('uploads') / file.name`), Windows `Path` interprets backslashes as directory separators, resolving the path outside the intended directory.\n\n### Impact\n\nOn Windows deployments of NiceGUI applications that use `file.name` in path construction:\n\n- **Arbitrary file write** outside the intended upload directory\n- **Potential remote code execution** through overwriting application files or placing executables in known locations\n- **Data integrity loss** through overwriting existing files\n\nLinux and macOS are not affected, as they treat backslashes as literal filename characters.","published":"2026-04-08T20:13:31.935Z","modified":"2026-10-28T02:30:53.018632805Z","cvss":{"score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"nicegui","fixedVersion":"3.10.0"}],"fix":{"url":"https://github.com/zauberzeug/nicegui/commit/d38a702e3af2da5b0708f689be8d71413fc77056","label":"zauberzeug/nicegui@d38a702"},"references":[{"type":"WEB","url":"https://github.com/zauberzeug/nicegui/releases/tag/v3.10.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39844.json"},{"type":"ADVISORY","url":"https://github.com/zauberzeug/nicegui/security/advisories/GHSA-w8wv-vfpc-hw2w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39844"},{"type":"FIX","url":"https://github.com/zauberzeug/nicegui/commit/d38a702e3af2da5b0708f689be8d71413fc77056"},{"type":"PACKAGE","url":"https://github.com/zauberzeug/nicegui"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:53.018632805Z"}}