The vulnerability resides in NiceGUI's FileUpload.name property, which exposes the client‑supplied filename without sanitization. When a developer assembles a file path by concatenating UPLOAD_DIR with file.name, attackers can supply filenames containing ../ sequences. This causes the application to write files outside the intended upload directory, leading to arbitrary file overwrite. If an attacker overwrites a critical executable or configuration file, it may result in remote code execution. The flaw is a classic path traversal vulnerability, classified as CWE-22.

The issue affects all deployments of the open‑source NiceGUI framework prior to version 3.7.0. Any application that uses the standard upload component and directly inserts file.name into a filesystem path is susceptible. Systems that rely on fixed paths, automatically generated filenames, or have already applied sanitization are not impacted.

The CVSS score of 7.5 indicates high severity. EPSS states an exploitation probability of less than 1%, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires the attacker to access the file upload endpoint of a NiceGUI application that uses user‑supplied filenames as path components. Successful exploitation would allow an attacker to overwrite arbitrary files, potentially enabling remote code execution or other destructive actions. The attack vector is inferred to be remote, relying on the web interface's file upload functionality, but it is only feasible in projects that adopt the documented pattern without additional safeguards.