NiceGUI, a Python‑based UI framework, contains a path‑traversal flaw in its handling of upload filenames. The sanitization routine PurePosixPath removes only forward slashes, so an attacker can embed backslashes in the filename to escape the intended upload directory. This allows a malicious actor to write arbitrary files to the server file system, compromising device integrity and potentially enabling further attacks. The flaw falls under the CWE-22 (Path Traversal) classification and scores a CVSS 5.9, indicating moderate severity.

Applications built with NiceGUI version 3.9 and earlier are vulnerable when running on Windows, because backslashes are treated as path separators. The issue does not affect non‑Windows platforms or later releases using built‑in path handling that sanitizes filenames properly.

The vulnerability is not listed in the CISA KEV catalog and lacks an EPSS score, but its CVSS rating signifies a moderate risk. An attacker can exploit the flaw by submitting a crafted file name during the upload process. Successful exploitation would yield the ability to create or overwrite files on the server, threatening confidentiality, integrity, and potentially availability of the application. No active exploits are currently reported, though the directory traversal nature makes it a high priority for remediation.