CVE-2026-39844 NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes / as path separators, an attacker can bypass this sanitization on Windows by using backslashes \ in the upload filename. Applications that construct file paths using file.name a pattern...

CVE-2026-39844 NiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath Sanitization

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes / as path separators, an attacker can bypass this sanitization on Windows by using backslashes \ in the upload filename. Applications that construct file paths using file.name a pattern...

CVE-2026-39844

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes / as path separators, an attacker can bypass this sanitization on Windows by using backslashes in the upload filename. Applications that construct file paths using file.name a pattern...

ai-plays-jackbox (>=0.0.1, <=0.3.2), aignostics (>=0.2.200, <=0.2.226) +55 more potentially affected by CVE-2026-39844 via nicegui (>=0.5.9, <=3.8.0)

nicegui PYPI version =0.5.9, =0.0.1, =0.2.200, =0.0.0, =0.1.0, =0.1.3, =0.1.0, =1.1.3, =0.6.7, =1.0.0, =1.2.0, =1.23.0 and more Source cves: CVE-2026-39844 Source advisory: MEND:CVE-2026-39844...

NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows

Summary The upload filename sanitization introduced in GHSA-9ffm-fxg3-xrhh uses PurePosixPathfilename.name to strip path components. Since PurePosixPath only recognizes forward slashes / as path separators, an attacker can bypass this sanitization on Windows by using backslashes \ in the upload...

EUVD-2026-20610

NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows...

Directory Traversal

Overview nicegui is a Create web-based user interfaces with Python. The nice way. Affected versions of this package are vulnerable to Directory Traversal via improper sanitization of uploaded filenames in the uploadfiles.py. An attacker can overwrite arbitrary files outside the intended upload...

GHSA-W8WV-VFPC-HW2W NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows

Summary The upload filename sanitization introduced in GHSA-9ffm-fxg3-xrhh uses PurePosixPathfilename.name to strip path components. Since PurePosixPath only recognizes forward slashes / as path separators, an attacker can bypass this sanitization on Windows by using backslashes \ in the upload...

rosys (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-39844 via nicegui (0.5.9)

nicegui PYPI version 0.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.3.0, =0.3.1 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

rosys (0.3.2) potentially affected by CVE-2026-39844 via nicegui (0.6.1)

nicegui PYPI version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.3.2 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

rosys (>=0.3.3, <=0.4.5) potentially affected by CVE-2026-39844 via nicegui (0.6.5)

nicegui PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.3.3, =0.4.5 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

rosys (0.4.9) potentially affected by CVE-2026-39844 via nicegui (0.6.9)

nicegui PYPI version 0.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.4.9 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

rosys (>=0.4.10, <=0.4.12) potentially affected by CVE-2026-39844 via nicegui (0.6.10)

nicegui PYPI version 0.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.10, =0.4.12 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

rosys (>=0.4.13, <=0.5.0) potentially affected by CVE-2026-39844 via nicegui (0.6.12)

nicegui PYPI version 0.6.12 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.13, =0.5.0 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

rosys (>=0.5.1, <=0.5.2) potentially affected by CVE-2026-39844 via nicegui (0.7.2)

nicegui PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.1, =0.5.2 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

rosys (>=0.5.3, <=0.5.10) potentially affected by CVE-2026-39844 via nicegui (0.7.6)

nicegui PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.3, =0.5.10 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

rosys (>=0.5.11, <=0.5.12) potentially affected by CVE-2026-39844 via nicegui (0.7.10)

nicegui PYPI version 0.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.11, =0.5.12 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

rosys (0.5.13) potentially affected by CVE-2026-39844 via nicegui (0.7.15)

nicegui PYPI version 0.7.15 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.5.13 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

rosys (>=0.5.14, <=0.5.17) potentially affected by CVE-2026-39844 via nicegui (0.7.21)

nicegui PYPI version 0.7.21 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.14, =0.5.17 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...

rosys (>=0.5.18, <=0.5.21) potentially affected by CVE-2026-39844 via nicegui (0.7.27)

nicegui PYPI version 0.7.27 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.18, =0.5.21 Source cves: CVE-2026-39844 Source advisory: OSV:GHSA-W8WV-VFPC-HW2W...