Detections
Analytics
SCA: security update for nicegui (GHSA-9ffm-fxg3-xrhh)
high Tenable Self-Hosted Container Security Plugin ID 437580
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-
supplied filename metadata without sanitization, enabling path traversal when developers use the pattern
UPLOAD_DIR / file.name. Malicious filenames containing ../ sequences allow attackers to write files
outside intended directories, with potential for remote code execution through application file overwrites
in vulnerable deployment patterns. This design creates a prevalent security footgun affecting applications
following common community patterns. Note: Exploitation requires application code incorporating file.name
into filesystem paths without sanitization. Applications using fixed paths, generated filenames, or
explicit sanitization are not affected. This vulnerability is fixed in 3.7.0. (CVE-2026-25732)
Solution
Update the nicegui library and its related packages to version 3.7.0 or later.See Also
Plugin Details
Severity: High
ID: 437580
Version: Revision 1.9
Type: Local
Family: SCA Checks
Published: 2/6/2026
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.39
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.1
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:N
CVSS Score Source: CVE-2026-25732
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 2/5/2026
Vulnerability Publication Date: 2/5/2026
Reference Information
CVE: CVE-2026-25732