p PatchFirst

CVE-2024-32005

CVE-2024-32005 · Local File Inclusion in NiceGUI leaflet component

This page contains facts from public vulnerability sources. Check the original advisory before updating.

NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. As a result any file on the backend filesystem which the web server has access to can be read by an attacker with access to the NiceUI leaflet website. This vulnerability has been addressed in version 1.4.21. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 8.2 · High · EPSS 0.8% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • nicegui

    Versions
    • >= 1.4.6, < 1.4.21: Affected

    No fix published

  • nicegui PyPI

    Versions
    • 1.4.10
    • 1.4.11
    • 1.4.12
    • 1.4.13
    • 1.4.14
    • 1.4.15
    • 1.4.16
    • 1.4.17
    • 1.4.18
    • 1.4.19
    • 1.4.20
    • 1.4.6
    • 1.4.7
    • 1.4.8
    • 1.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 1.4.6, < 1.4.21

    Update to 1.4.21

Original sources

Check your server →