CVE-2026-25732-NiceGUI-3.6.1

Author: Mohammed Idrees Banyamer Contact: Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer CVE-2026-25732 — NiceGUI Path Traversal in FileUpload → Arbitrary File Write Exploit Title: NiceGUI Path Traversal in FileUpload Leading to Arbitrary File Write Date: 2025-06-06 Tested on:...

CVE-2025-66470

NiceGUI XSS Scanner - CVE-2025-66470 📸 Screenshot A fast, simple scanner for detecting CVE-2025-66470 - XSS vulnerability in NiceGUI's ui.interactiveimage component. 🔍 Vulnerability Details Field| Value ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Component| ui.interactiveimage Affected|...

PYSEC-2026-2680 NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

Summary Two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log...

NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

SummaryTwo FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log ...

rosys (0.5.13) potentially affected by CVE-2026-45553 via nicegui (0.7.15)

nicegui PYPI version 0.7.15 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.5.13 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

synth-mapping-helper (1.5.9) potentially affected by CVE-2026-45553 via nicegui (2.8.1)

nicegui PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper 1.5.9 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

rosys (>=0.5.11, <=0.5.12) potentially affected by CVE-2026-45553 via nicegui (0.7.10)

nicegui PYPI version 0.7.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.11, =0.5.12 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

rosys (>=0.5.1, <=0.5.2) potentially affected by CVE-2026-45553 via nicegui (0.7.2)

nicegui PYPI version 0.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.1, =0.5.2 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

rosys (>=0.5.14, <=0.5.17) potentially affected by CVE-2026-45553 via nicegui (0.7.21)

nicegui PYPI version 0.7.21 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.14, =0.5.17 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

openadapt (0.7.1) potentially affected by CVE-2026-45553 via nicegui (1.2.16)

nicegui PYPI version 1.2.16 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openadapt 0.7.1 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

mcp-open-client (0.4.27), synth-mapping-helper (>=1.5.16, <=1.5.18) potentially affected by CVE-2026-45553 via nicegui (2.21.1)

nicegui PYPI version 2.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - mcp-open-client 0.4.27 - synth-mapping-helper =1.5.16, =1.5.18 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

rosys (>=0.8.4, <=0.8.5) potentially affected by CVE-2026-45553 via nicegui (1.2.17)

nicegui PYPI version 1.2.17 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.8.4, =0.8.5 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

rosys (>=0.4.10, <=0.4.12) potentially affected by CVE-2026-45553 via nicegui (0.6.10)

nicegui PYPI version 0.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.4.10, =0.4.12 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

rosys (0.3.2) potentially affected by CVE-2026-45553 via nicegui (0.6.1)

nicegui PYPI version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.3.2 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

rosys (0.8.3) potentially affected by CVE-2026-45553 via nicegui (1.2.10)

nicegui PYPI version 1.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys 0.8.3 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

rosys (>=0.5.22, <=0.5.24) potentially affected by CVE-2026-45553 via nicegui (0.7.29)

nicegui PYPI version 0.7.29 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.5.22, =0.5.24 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

synth-mapping-helper (>=1.5.1, <=1.5.2) potentially affected by CVE-2026-45553 via nicegui (2.3.0)

nicegui PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.5.1, =1.5.2 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

openadapt (>=0.17.0, <=0.26.2) potentially affected by CVE-2026-45553 via nicegui (1.4.9)

nicegui PYPI version 1.4.9 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - openadapt =0.17.0, =0.26.2 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

synth-mapping-helper (>=1.4.8, <=1.5.0) potentially affected by CVE-2026-45553 via nicegui (1.4.36)

nicegui PYPI version 1.4.36 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - synth-mapping-helper =1.4.8, =1.5.0 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...

rosys (>=0.3.3, <=0.4.5) potentially affected by CVE-2026-45553 via nicegui (0.6.5)

nicegui PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on nicegui and may be impacted: - rosys =0.3.3, =0.4.5 Source cves: CVE-2026-45553 Source advisory: OSV:PYSEC-2026-2679...