CVE-2026-39844

Medium

Published: 08 April 2026

Published

08 April 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Score 0.0006 19.7th percentile

Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-39844 is a medium-severity Path Traversal (CWE-22) vulnerability in Zauberzeug Nicegui. Its CVSS base score is 5.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the path traversal vulnerability by requiring validation and sanitization of uploaded filenames to reject or normalize path separators like backslashes on Windows.

SI-2 Flaw Remediation good match

prevent

Mandates timely flaw remediation, such as patching NiceGUI to version 3.10.0, which fixes the PurePosixPath sanitization failure on Windows.

AC-6 Least Privilege partial match

prevent

Enforces least privilege on the application process to limit the scope of arbitrary file writes to non-critical locations even if traversal succeeds.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

The path traversal in the public-facing NiceGUI web UI framework enables remote unauthenticated exploitation via crafted file upload (T1190). This directly facilitates arbitrary file writes that can be used to place web shells on the server (T1505.003).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (\) in the upload filename. Applications that construct file paths…

using file.name (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. This vulnerability is fixed in 3.10.0.

Deeper analysisAI

CVE-2026-39844 is a path traversal vulnerability (CWE-22) affecting NiceGUI, a Python-based UI framework, in versions prior to 3.10.0. The issue stems from the use of PurePosixPath for sanitizing uploaded filenames, which only recognizes forward slashes (/) as path separators and fails to handle backslashes (\) on Windows systems. Applications that construct file paths directly from the uploaded file.name attribute, as shown in NiceGUI's bundled examples, are vulnerable to arbitrary file writes outside the intended directory on Windows hosts.

A remote, unauthenticated attacker can exploit this vulnerability over the network by uploading a malicious file with backslashes in its filename, bypassing path normalization. This requires high attack complexity (AC:H per CVSS v3.1 score of 5.9), such as crafting a precise filename to traverse directories. Successful exploitation enables arbitrary file writes on the server (I:H), potentially allowing attackers to overwrite critical files, though it does not grant confidentiality or availability impact (C:N/A:N).

The vulnerability is addressed in NiceGUI version 3.10.0, where the sanitization logic was updated via commit d38a702e3af2da5b0708f689be8d71413fc77056. Security practitioners should upgrade to 3.10.0 or later and review applications for direct use of file.name in path construction, implementing additional platform-agnostic path normalization (e.g., using pathlib.Path with proper resolution) as a mitigation. Further details are available in the NiceGUI security advisory (GHSA-w8wv-vfpc-hw2w) and release notes.