GHSA-75w7-4mx9-8qqc: 
Python vulnerability analysis and mitigation

Summary

NiceGUI strips directory components from the names of uploaded files, so that FileUpload.name can be joined onto an upload directory, as the bundled examples do. The fix for GHSA-w8wv-vfpc-hw2w strips both forward slashes and backslashes, but not Windows drive prefixes. A file name like C:evil.py therefore passed unchanged. On Windows, joining such a name onto a directory discards that directory whenever it is relative or located on a different drive, so the file is written outside the intended upload directory.

Impact

Windows deployments of NiceGUI applications that save uploaded files under a path built from FileUpload.name are affected if the upload directory is relative, e.g. Path('uploads') / file.name, or on a different drive than the one named in the file name. Anyone who can reach a ui.upload element can write a file into the current working directory of that drive, which may overwrite application files and, depending on the deployment, lead to code execution. Directory traversal with .. is not possible. Linux and macOS are not affected, because they do not interpret drive prefixes. Applications that do not use the client-supplied file name in paths, or that save to an absolute upload directory on the same drive, are not affected either.

Patches

Fixed in NiceGUI 3.19.0. The sanitization now applies the Windows rules for file names, which strip drive prefixes as well as both kinds of path separators, regardless of the server's operating system. Upgrade to 3.19.0 or later.

Workarounds

If upgrading is not immediately possible, do not use the client-supplied file name as a path. Generate the stored file name on the server, e.g. with uuid.uuid4().hex, and keep the original name only as metadata. Otherwise, resolve the joined path and check that it lies within the upload directory before writing, e.g. with Path.is_relative_to().