CVE-2026-25732-NiceGUI-3.6.1

Author: Mohammed Idrees Banyamer Contact: Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer CVE-2026-25732 — NiceGUI Path Traversal in FileUpload → Arbitrary File Write Exploit Title: NiceGUI Path Traversal in FileUpload Leading to Arbitrary File Write Date: 2025-06-06 Tested on:...

CVE-2025-66470

NiceGUI XSS Scanner - CVE-2025-66470 📸 Screenshot A fast, simple scanner for detecting CVE-2025-66470 - XSS vulnerability in NiceGUI's ui.interactiveimage component. 🔍 Vulnerability Details Field| Value ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Component| ui.interactiveimage Affected|...

NiceGUI Detection

An instance running NiceGUI is detected by looking for specific HTTP headers. !/usr/bin/env python3 -- coding: utf-8 -- """An instance running NiceGUI is detected by looking for specific HTTP headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

rosys (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-45554 via nicegui (0.5.9)

nicegui PYPI version 0.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.3.0, =0.3.1 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

PYSEC-2026-2680 NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

Summary Two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log...

rosys (>=0.5.1, <=0.5.2) potentially affected by CVE-2026-45554 via nicegui (0.7.2)

nicegui PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.1, =0.5.2 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

rosys (>=0.5.18, <=0.5.21) potentially affected by CVE-2026-45554 via nicegui (0.7.27)

nicegui PYPI version 0.7.27 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.18, =0.5.21 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

rosys (>=0.5.3, <=0.5.10) potentially affected by CVE-2026-45554 via nicegui (0.7.6)

nicegui PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.3, =0.5.10 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

rosys (0.5.13) potentially affected by CVE-2026-45554 via nicegui (0.7.15)

nicegui PYPI version 0.7.15 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.5.13 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

finalynx (>=1.2.0, <=1.14.4) potentially affected by CVE-2026-45554 via nicegui (1.4.25)

nicegui PYPI version 1.4.25 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - finalynx =1.2.0, =1.14.4 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

air-link (>=0.0.0, <=0.2.1), broh5 (1.3.2) +16 more potentially affected by CVE-2026-45554 via nicegui (1.4.37)

nicegui PYPI version 1.4.37 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - air-link =0.0.0, =0.1.0, =1.1.3, =0.6.7, =1.0.0, =1.14.5, =0.0.2a5, =1.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves:...

synth-mapping-helper (>=1.5.1, <=1.5.2) potentially affected by CVE-2026-45554 via nicegui (2.3.0)

nicegui PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.1, =1.5.2 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

synth-mapping-helper (>=1.5.3, <=1.5.7) potentially affected by CVE-2026-45554 via nicegui (2.5.0)

nicegui PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.3, =1.5.7 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

rosys (0.8.3) potentially affected by CVE-2026-45554 via nicegui (1.2.10)

nicegui PYPI version 1.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.8.3 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

rosys (>=0.8.4, <=0.8.5) potentially affected by CVE-2026-45554 via nicegui (1.2.17)

nicegui PYPI version 1.2.17 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.8.4, =0.8.5 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

forta-gate (0.1.0), openadapt (>=0.9.0, <=0.16.2) potentially affected by CVE-2026-45554 via nicegui (1.4.7)

nicegui PYPI version 1.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - forta-gate 0.1.0 - openadapt =0.9.0, =0.16.2 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

kayalab (>=0.1.0, <=0.7.29) potentially affected by CVE-2026-45554 via nicegui (1.4.13)

nicegui PYPI version 1.4.13 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - kayalab =0.1.0, =0.7.29 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

openorchestrator (>=1.1.0, <=1.3.1) potentially affected by CVE-2026-45554 via nicegui (1.4.12)

nicegui PYPI version 1.4.12 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openorchestrator =1.1.0, =1.3.1 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

kayalab (>=0.7.30, <=0.11.9) potentially affected by CVE-2026-45554 via nicegui (1.4.24)

nicegui PYPI version 1.4.24 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - kayalab =0.7.30, =0.11.9 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...

aignostics (>=0.2.200, <=0.2.226), auth-web-kit (>=0.1.0, <=1.2.1) +13 more potentially affected by CVE-2026-45554 via nicegui (>=3.0.0rc1, <=3.10.0)

nicegui PYPI version =3.0.0rc1, =0.2.200, =0.1.0, =0.1.3, =0.9.0, =0.12.0, =1.0.126, =0.1.10.31, =0.3.1, =0.4.24, =1.0.0, =1.5.20, =12.22.3, =12.22.5 Source cves: CVE-2026-45554 Source advisory: OSV:PYSEC-2026-2680...