CVE-2025-66645

Description

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version 3.4.0.

PUBLISHED Reserved 2025-12-05 | Published 2025-12-09 | Updated 2025-12-10 | Assigner GitHub_M

Problem types

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

References

github.com/...icegui/security/advisories/GHSA-hxp3-63hc-5366 exploit

github.com/...icegui/security/advisories/GHSA-hxp3-63hc-5366

github.com/...ommit/a1b89e2a24e1911a40389ace2153a37f4eea92a9

cve.org (CVE-2025-66645)

nvd.nist.gov (CVE-2025-66645)

Download JSON