The upload filename sanitization introduced in GHSA-9ffm-fxg3-xrhh uses PurePosixPath(filename).name to strip path components. Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\) in the upload filename.
Applications that construct file paths using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows.
The sanitization in nicegui/elements/upload_files.py uses:
filename = PurePosixPath(upload.filename or '').name
PurePosixPath treats backslashes as literal characters, not path separators:
>>> PurePosixPath('..\\..\\secret\\evil.txt').name
'..\\..\\secret\\evil.txt' # Not stripped!
When this filename is used in a path operation on Windows (e.g., Path('uploads') / file.name), Windows Path interprets backslashes as directory separators, resolving the path outside the intended directory.
On Windows deployments of NiceGUI applications that use file.name in path construction:
Linux and macOS are not affected, as they treat backslashes as literal filename characters.
| Score | Percentile |
|---|---|
| 0.06% | 18.26% |
| Base score | Version | Severity | Vector |
|---|---|---|---|
| 5.9 | 3.1 | — |
|
| Type | Value |
|---|---|
| GHSA | GHSA-w8wv-vfpc-hw2w ↗ |
| CVE | CVE-2026-39844 ↗ |
| CWE id | Name |
|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| pip | nicegui | <= 3.9.0 | 3.10.0 | — |