CVE-2026-39844

描述

### Summary The upload filename sanitization introduced in GHSA-9ffm-fxg3-xrhh uses `PurePosixPath(filename).name` to strip path components. Since `PurePosixPath` only recognizes forward slashes (`/`) as path separators, an attacker can bypass this sanitization on Windows by using backslashes (`\`) in the upload filename. Applications that construct file paths using `file.name` (a pattern demonstrated in NiceGUI's bundled examples) are vulnerable to arbitrary file write on Windows. ### Details The sanitization in `nicegui/elements/upload_files.py` uses: ```python filename = PurePosixPath(upload.filename or '').name ``` `PurePosixPath` treats backslashes as literal characters, not path separators: ```python >>> PurePosixPath('..\\..\\secret\\evil.txt').name '..\\..\\secret\\evil.txt' # Not stripped! ``` When this filename is used in a path operation on Windows (e.g., `Path('uploads') / file.name`), Windows `Path` interprets backslashes as directory separators, resolving the path outside the intended directory. ### Impact On Windows deployments of NiceGUI applications that use `file.name` in path construction: - **Arbitrary file write** outside the intended upload directory - **Potential remote code execution** through overwriting application files or placing executables in known locations - **Data integrity loss** through overwriting existing files Linux and macOS are not affected, as they treat backslashes as literal filename characters.

如何修補 CVE-2026-39844

要修補 CVE-2026-39844,請將受影響套件升級到下列已修補版本。

• —升級至 3.10.0 或更新版本
• —升級至 3.10.0 或更新版本

CVE-2026-39844 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 3.10.0