GHSA-w8wv-vfpc-hw2w: NiceGUI: Upload filename sanitization bypass via backslashes allows path traversal on Windows
Summary
NiceGUI has a security flaw where file upload names aren't properly cleaned on Windows. An attacker can use backslashes in filenames to bypass the sanitization check, which only recognizes forward slashes as path separators. This allows them to write files outside the intended upload folder, potentially overwriting important files or running malicious code. Linux and macOS are not affected because they treat backslashes as regular characters in filenames.
Vulnerability Details
EPSS: 0.0%
Yes
April 8, 2026
Classification
Taxonomy References
Affected Vendors
Affected Packages
Related Issues
Original source: https://github.com/advisories/GHSA-w8wv-vfpc-hw2w
First tracked: April 8, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 75%