CVE-2026-45554 in nicegui
Summary
by MITRE • 06/02/2026
NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. This issue has been patched in version 3.12.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/02/2026
This vulnerability affects NiceGUI versions prior to 3120 where two FastAPI routes designed to serve per-component static assets contain a critical flaw in their path handling mechanism. The routes accept a sub-path parameter that can resolve to directories instead of files, creating an exploitable condition that leads to unhandled runtime errors. When a request resolves to a directory rather than a specific file, the underlying Starlette FileResponse component throws a RuntimeError that gets propagated through the Uvicorn server and written to server logs as a complete traceback. This represents a significant security concern as the affected routes are publicly accessible without authentication requirements, making them immediately exploitable by remote attackers who can leverage this vulnerability to generate excessive log output.
The technical implementation of this vulnerability stems from improper input validation within the FastAPI route handlers that serve static assets in the NiceGUI framework. When a malicious request is made to these routes, the path parameter processing fails to properly validate that the resolved path points to a file rather than a directory structure. This validation gap allows attackers to manipulate the sub-path parameter to traverse directory structures, ultimately causing the FileResponse component to attempt to serve directory contents rather than individual files. The error handling mechanism within Starlette's FileResponse component is inadequate for this specific scenario, resulting in a RuntimeError that gets logged as a full traceback rather than being gracefully handled or rejected.
The operational impact of this vulnerability extends beyond simple log flooding, creating substantial resource consumption issues for affected systems. Remote attackers can amplify log volume significantly by crafting requests that resolve to directories, leading to rapid disk space exhaustion and overwhelming log processing pipelines. This type of attack can effectively create a denial of service condition by consuming system resources through excessive logging, potentially impacting system performance and availability. The vulnerability affects any publicly accessible NiceGUI server running versions prior to 3120, making it particularly dangerous in production environments where logging infrastructure may not be adequately monitored or protected against such resource exhaustion attacks.
The vulnerability aligns with several cybersecurity frameworks and threat models, particularly mapping to CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-400 Uncontrolled Resource Consumption. From an ATT&CK perspective, this represents a resource exhaustion technique that can be used to consume system resources and potentially disrupt service availability. The lack of authentication requirements for the affected routes places this vulnerability in the category of accessible attack surfaces that can be leveraged by threat actors without prior access credentials. Organizations using NiceGUI should prioritize immediate patching to version 3120 or later, as this update resolves the path validation issues and prevents the problematic directory resolution behavior that leads to the runtime errors and excessive logging.
Mitigation strategies should focus on both immediate patching and defensive measures to protect against similar vulnerabilities. System administrators should implement monitoring for unusual log volume patterns and establish log rotation policies to prevent disk space exhaustion. Additionally, network-level controls such as rate limiting and access control lists can help reduce the impact of such attacks by limiting the number of requests that can be made to the vulnerable endpoints. Organizations should also consider implementing centralized logging with appropriate alerting mechanisms to detect and respond to abnormal logging activity that might indicate exploitation attempts. The patch in version 3120 specifically addresses the core path validation issue by ensuring that only valid file paths are processed, preventing the directory resolution that leads to the RuntimeError condition.