CVE-2025-66645: NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read

December 9, 2025 (updated January 8, 2026)

A directory traversal vulnerability in NiceGUI’s App.add_media_files() allows a remote attacker to read arbitrary files on the server filesystem.

References

github.com/advisories/GHSA-hxp3-63hc-5366
github.com/zauberzeug/nicegui
github.com/zauberzeug/nicegui/commit/a1b89e2a24e1911a40389ace2153a37f4eea92a9
github.com/zauberzeug/nicegui/security/advisories/GHSA-hxp3-63hc-5366
nvd.nist.gov/vuln/detail/CVE-2025-66645

Code Behaviors & Features

Detect and mitigate CVE-2025-66645 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →