https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 19:34:48 +0000 https://cve.radiocsirt.org/vuln/cve-2025-66645 <p><strong>Affected:</strong> zauberzeug nicegui</p> <p>NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version 3.4.0.</p> <p><strong>Affected:</strong> zauberzeug nicegui</p> <p>NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version 3.4.0.</p> https://cve.radiocsirt.org/vuln/cve-2025-66645 https://cve.radiocsirt.org/vuln/pysec-2026-1700 <p><strong>Affected:</strong> PyPI: nicegui</p> <p>### Summary</p> <p>A directory traversal vulnerability in NiceGUI&#39;s `App.add_media_files()` allows a remote attacker to read arbitrary files on the server filesystem.</p> <p>### Details</p> <p>Hello, I am Seungbin Yang, a university student studying cybersecurity. While reviewing the source code of the repository, I discovered a potential vulnerability and successfully verified it with a PoC.</p> <p>The `App.add_media_files(url_path, local_directory)` method allows users to serve media files. However, the implementation lacks proper path validation.</p> <p>```python def add_media_files(self, url_path: str, local_directory: Union[str, Path]) -&gt; None: @self.get(url_path.rstrip(&#39;/&#39;) + &#39;/{filename:path}&#39;) def read_item(request: Request, filename: str, nicegui_chunk_size: int = 8192) -&gt; Response: filepath = Path(local_directory) / filename if not filepath.is_file(): raise HTTPException(status_code=404, detail=&#39;Not Found&#39;) return get_range_response(filepath, request, chunk_size=nicegui_chunk_size) ``` Root Cause: 1. The `{filename:path}` parameter accepts full paths, including traversal sequences like `../`. 2. The code simply joins local_directory and filename without checking if the result is still inside the local_directory. 3. There is no path sanitization or boundary check.</p> <p>Consequence: An attacker can use `..` to access files outside the intended directory. If the application has permission, sensitive files (e.g., /etc/hosts, source code, config files) can be…</p> <p><strong>Affected:</strong> PyPI: nicegui</p> <p>### Summary</p> <p>A directory traversal vulnerability in NiceGUI&#39;s `App.add_media_files()` allows a remote attacker to read arbitrary files on the server filesystem.</p> <p>### Details</p> <p>Hello, I am Seungbin Yang, a university student studying cybersecurity. While reviewing the source code of the repository, I discovered a potential vulnerability and successfully verified it with a PoC.</p> <p>The `App.add_media_files(url_path, local_directory)` method allows users to serve media files. However, the implementation lacks proper path validation.</p> <p>```python def add_media_files(self, url_path: str, local_directory: Union[str, Path]) -&gt; None: @self.get(url_path.rstrip(&#39;/&#39;) + &#39;/{filename:path}&#39;) def read_item(request: Request, filename: str, nicegui_chunk_size: int = 8192) -&gt; Response: filepath = Path(local_directory) / filename if not filepath.is_file(): raise HTTPException(status_code=404, detail=&#39;Not Found&#39;) return get_range_response(filepath, request, chunk_size=nicegui_chunk_size) ``` Root Cause: 1. The `{filename:path}` parameter accepts full paths, including traversal sequences like `../`. 2. The code simply joins local_directory and filename without checking if the result is still inside the local_directory. 3. There is no path sanitization or boundary check.</p> <p>Consequence: An attacker can use `..` to access files outside the intended directory. If the application has permission, sensitive files (e.g., /etc/hosts, source code, config files) can be…</p> https://cve.radiocsirt.org/vuln/pysec-2026-1700