TI-2026-33303 Aliases CVE-2026-45554 GHSA-pq7c-x8g4-rvp6

NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes

LOW 30CWE-248Published 2026-06-02 · Updated 2026-06-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.

Summary

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. This issue has been patched in version 3.12.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00343 27th percentileScored 2026-11-07

Fix Fixed nicegui (zauberzeug): 3.12.0nicegui (PyPI): 3.12.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zauberzeug	nicegui	before 3.12.0	3.12.0	Patch available	CNA
—	nicegui (PyPI)	before 3.12.0	3.12.0	Patch available	GHSA-pq7c-x8g4-rvp6

nicegui Vendorzauberzeug Affected before 3.12.0 Fixed in 3.12.0 Patch available CNA
nicegui (PyPI) Vendor— Affected before 3.12.0 Fixed in 3.12.0 Patch available GHSA-pq7c-x8g4-rvp6

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:zauberzeug:nicegui::::::::	—	—	zauberzeug

cpe:2.3:a:zauberzeug:nicegui:*:*:*:*:*:*:*:* Versions — — ·zauberzeug

Remediation

Fix · CNA nicegui (zauberzeug) Fixed in 3.12.0
Fix · GHSA-pq7c-x8g4-rvp6 nicegui (PyPI) Fixed in 3.12.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-45554
2026-10-03 Alias added: GHSA-pq7c-x8g4-rvp6

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-45554

Other 3

TI-2024-21104 Local File Inclusion in NiceGUI leaflet component CVSS 3.1HIGH 8.2
TI-2025-41029 NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading CVSS 3.1HIGH 7.5
TI-2025-15578 NiceGUI On Air authentication issue CVSS 3.1HIGH 7.5
TI-2026-17574 Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages` CVSS 3.1HIGH 7.2
TI-2026-17575 NiceGUI has Redis connection leak via tab storage causes service degradation CVSS 3.1MEDIUM 5.3
TI-2026-17573 NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links CVSS 3.1MEDIUM 6.1

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences