NiceGUI hat eine Pfadüberschreitung in app.add_media_files(), die das beliebige Lesen von Dateien ermöglicht

The core of the vulnerability lies in the App.addmediafiles(urlpath, localdirectory) function, which is intended to serve media files. The lack of robust path validation allows an attacker to craft malicious urlpath inputs containing directory traversal sequences (e.g., ../..). By manipulating this input, an attacker can bypass intended access controls and read files outside of the intended localdirectory. This could expose sensitive configuration files, source code, or other confidential data stored on the server. The potential blast radius depends on the server's configuration and the permissions of the NiceGUI process. If the NiceGUI process runs with elevated privileges, the attacker's access could extend beyond the application's directory.

Organizations and individuals deploying NiceGUI applications, particularly those serving media files, are at risk. Shared hosting environments where multiple users share the same server are especially vulnerable, as an attacker could potentially exploit this vulnerability to access files belonging to other users.

• python / server:

# Check for vulnerable NiceGUI versions
python -c "import nicegui; print(nicegui.__version__)"

• generic web:

curl -I 'http://your-nicegui-app/path/../sensitive/file.txt' # Check for file disclosure

1. 2025-12-09Disclosure

   disclosure

1. Reserviert2025-12-05
2. Veröffentlicht2025-12-09
3. Geändert2026-02-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-66645 is to upgrade NiceGUI to version 3.4.0 or later, which includes the necessary path validation fixes. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out requests containing directory traversal sequences in the urlpath parameter. Additionally, restrict the permissions of the NiceGUI process to the minimum required to operate, limiting the potential damage if the vulnerability is exploited. Carefully review the localdirectory configuration to ensure it points to a secure and restricted location. No specific Sigma or YARA rules are readily available, but custom rules can be developed to detect suspicious file access patterns.