CVE-2025-66645
📋 TL;DR
This directory traversal vulnerability in NiceGUI allows remote attackers to read arbitrary files on the server filesystem by exploiting the App.add_media_files() function. Any application using NiceGUI versions 3.3.1 or below is affected, potentially exposing sensitive server files.
💻 Affected Systems
- NiceGUI
📦 What is this software?
Nicegui by Zauberzeug
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through reading sensitive files like SSH keys, configuration files, or database credentials, leading to data exfiltration or further system exploitation.
Likely Case
Unauthorized access to sensitive application files, configuration data, or user information stored on the server filesystem.
If Mitigated
Limited impact with proper file permissions and network segmentation, though sensitive files could still be exposed if accessible to the application user.
🎯 Exploit Status
Directory traversal vulnerabilities are commonly exploited and require minimal technical skill. The advisory provides technical details that could be used to create exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.0
Vendor Advisory: https://github.com/zauberzeug/nicegui/security/advisories/GHSA-hxp3-63hc-5366
Restart Required: Yes
Instructions:
1. Update NiceGUI to version 3.4.0 or higher using pip: pip install --upgrade nicegui>=3.4.0
2. Restart your application server
3. Verify the update was successful
🔧 Temporary Workarounds
Input Validation Workaround
allImplement custom input validation for file paths in your application code before passing to add_media_files()
File Permission Restriction
linuxRun the application with minimal file system permissions and restrict access to sensitive directories
chmod -R 750 /path/to/application
chown -R appuser:appgroup /path/to/application
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all file path inputs
- Use application firewalls or reverse proxies to block directory traversal patterns in requests
🔍 How to Verify
Check if Vulnerable:
Check if NiceGUI version is 3.3.1 or below and if App.add_media_files() is used in your applicationCheck Version:
python -c "import nicegui; print(nicegui.__version__)"Verify Fix Applied:
Verify NiceGUI version is 3.4.0 or higher and test file access attempts with directory traversal patterns📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns
- Requests containing '../' or similar traversal sequences
- Access attempts to sensitive system paths
Network Indicators:
- HTTP requests with directory traversal patterns in file parameters
- Unusual file download patterns from the application
SIEM Query:
source="web_server" AND (uri="*../*" OR uri="*..\\*" OR uri="*%2e%2e%2f*")