CVE-2024-32005CWE-22CWE-23

Local File Inclusion in NiceGUI leaflet component

High · published April 12, 2024

CVSS v3.1
8.2
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. As a result any file on the backend filesystem which the web server has access to can be read by an attacker with access to the NiceUI leaflet website. This vulnerability has been addressed in version 1.4.21. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00760 · 54.8th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-23 · Relative Path Traversal
Published
2024-04-12T20:38Z
EPSS history
Timeline
  • 12 APR 20:38Z
    Local File Inclusion in NiceGUI leaflet component
    cvelistv5