{"id":"CVE-2025-66645","title":"NiceGUI is a Python-based UI framework","summary":"NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to  directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This iss…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-22"],"vendor":"zauberzeug","product":"nicegui","affected":["nicegui < 3.4.0"],"patched":["nicegui 3.4.0"],"published":"2025-12-09","updated":"2026-10-14","sourceUpdated":"2026-10-14T21:10:00.183","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66645","references":[{"url":"https://github.com/zauberzeug/nicegui/commit/a1b89e2a24e1911a40389ace2153a37f4eea92a9","label":"security-advisories@github.com"},{"url":"https://github.com/zauberzeug/nicegui/security/advisories/GHSA-hxp3-63hc-5366","label":"security-advisories@github.com"},{"url":"https://github.com/zauberzeug/nicegui/security/advisories/GHSA-hxp3-63hc-5366","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66645"},{"url":"https://github.com/zauberzeug/nicegui"}],"tags":["nvd","osv","pip","exploit-available"],"epss":0.0112,"epssPercentile":0.6601,"aliases":["GHSA-hxp3-63hc-5366","PYSEC-2026-1700"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:50.350Z","exploits":{"github":1,"githubRepos":["https://github.com/prokeon5991-wq/cve-2025-66645"],"checkedAt":"2026-10-27T16:49:11.683Z"},"exploitAvailable":true,"slug":"CVE-2025-66645","body":"## Overview\n\nNiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to  directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version 3.4.0.\n\n## Affected\n\n- `nicegui < 3.4.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `nicegui 3.4.0`\n\n## Package advisory (CVE-2025-66645)\n\nAffected packages:\n\n- `nicegui < 3.4.0`\n\nPatched in:\n\n- `nicegui 3.4.0`\n\nSource: https://osv.dev/vulnerability/GHSA-hxp3-63hc-5366","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":223876,"id":"CVE-2025-66645","ts":1792264456316,"field":"exploit_available","old":"false","new":"true"}]}