CVE-2025-66645 — NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading

CVE-2025-66645

NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading PUBLISHED

Description (CNA)

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version 3.4.0.

Affected (CNA)

Vendor / product	Versions
zauberzeug / nicegui	affected < 3.4.0

CWE

CWE-22

References

https://github.com/zauberzeug/nicegui/security/advisories/GHSA-hxp3-63hc-5366
https://github.com/zauberzeug/nicegui/commit/a1b89e2a24e1911a40389ace2153a37f4eea92a9

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/zauberzeug/nicegui/security/advisories/GHSA-hxp3-63hc-5366