CVE-2024-32005High· 8.2▾ TwilightNiceGUI allows potential access to local file system
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.8%
Last analysed / modified upstream
NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the /_nicegui/{__version__}/resources/{key}/{path:path} route.
As a result any file on the backend filesystem which the web server has access to can be read by an attacker with access to the NiceUI leaflet website.
This vulnerability has been addressed in version 1.4.21. Users are advised to upgrade. There are no known workarounds for this vulnerability.
nicegui >= 1.4.6, < 1.4.21Upgrade to a patched release:
nicegui 1.4.21Connected by shared product, vendor, weakness, or advisory.
CVE-2026-39844Medium· 5.9NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
CVE-2026-33332Medium· 5.3NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
CVE-2026-25516Medium· 6.1NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
CVE-2026-45554Medium· 5.3NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes
CVE-2026-45553High· 7.5NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()
CVE-2026-27156Medium· 6.1NiceGUI vulnerable to XSS via Code Injection during client-side element function execution