GHSA-9ffm-fxg3-xrhh NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write

• PyPI nicegui: < 3.7.0 → fixed in 3.7.0

Summary NiceGUI's `FileUpload.name` property exposes client-supplied filename metadata without sanitization, enabling path traversal when developers use the pattern `UPLOAD_DIR / file.name`. Malicious filenames containing `../` sequences allow attackers to write files outside intended directories, with potential for remote code execution through application file overwrites in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications following common community patterns. Note: Exploitation requires application code incorporating `file.name` into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or explicit sanitization are not affected. Details Vulnerable Component: `nicegui/elements/upload_files.py` (upload_files.py#L79-L82 and upload_files.py#L110-L115) Affected Methods: `SmallFileUpload.save()`and `LargeFileUpload.save()` ```py async def save(self, path: str | Path) -> None: target = Path(path) target.parent.mkdir(parents=True, exist_ok=True) await run.io_bound(target.write_bytes, self._data) ``` Root Cause: The `save()` method performs no validation on the provided path parameter. It accepts: • Relative paths with `../` sequences • Absolute paths • Any file system location writable by the process When developers use `e.file.name` (controlled by the attacker) in constructing save paths, directory traversal occurs: ```py save_path = UPLOAD_DIR / e.file.name # e.file.name = "../app.py" await e.file.save(save_path) # Writes outside UPLOAD_DIR ``` PoC • Terminal 1 (App) ```bash cd /tmp && mkdir -p evilgui && cd evilgui python3 -m venv evilgui && source evilgui/bin/activate pip install nicegui cat > vulnerable_app.py exploit.py None: target = Path(path).resolve() if base_dir is not None: base_dir = base_dir.resolve() if not target.is_relative_to(base_dir): raise ValueError( f"Path '{target}' escapes base directory '{base_dir}'" ) target.parent.mkdir(parents=True, exist_ok=True) await run.io_bound(target.write_bytes, self._data) ````