{"action":"Upgrade nicegui to 3.7.0 or later.","affected":[{"fixed":"3.7.0","introduced":"0"}],"component":"nicegui","cve_ids":["CVE-2026-25732"],"ecosystem":"PyPI","epss":0.03429,"exploited":false,"fixed_versions":["3.7.0"],"ghsa_id":"GHSA-9ffm-fxg3-xrhh","id":"tcs_01M5KHEJF2T4Z67MHK0NKFXR90","modified_at":"2026-05-20T09:19:09.073192Z","published_at":"2026-02-06T22:16:11.993Z","references":["https://osv.dev/vulnerability/PYSEC-2026-95","https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L110-L115","https://github.com/zauberzeug/nicegui/blob/main/nicegui/elements/upload_files.py#L79-L82","https://github.com/zauberzeug/nicegui/security/advisories/GHSA-9ffm-fxg3-xrhh"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-95","url":"https://osv.dev/vulnerability/PYSEC-2026-95"}],"summary":"NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use t"}