CVE-2025-66645

HighCVSS 7.5/10Last modified Oct 14, 2026

Description

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, which allows a remote attacker to read arbitrary files on the server filesystem. This issue is fixed in version 3.4.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Dec 9, 2025
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-666467.5RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other em CVE-2025-666479.8RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other em CVE-2025-666486.1vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to sup CVE-2025-66659.8A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. Affected by this vulnerability i CVE-2025-66662.0A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. Affected by this vulnerability is an unknown functionalit CVE-2025-666601.8Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID_SRIOV_CHECK_TA_COMPAT to c CVE-2025-666644.6Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE SOC Driver could allow an attacker to issue a malformed DRV_SOC_CMD_ID CVE-2025-66678.8A vulnerability was found in code-projects Car Rental System 1.0 and classified as critical. Affected by this issue is some unknown function CVE-2025-666758.2Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apac CVE-2025-666766.2An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.CVE-2025-666789.8An issue in the HwRwDrv.sys component of Nil Hardware Editor Hardware Read & Write Utility v1.25.11.26 and earlier allows attackers to execu CVE-2025-66689.8A vulnerability was found in code-projects Inventory Management System 1.0. It has been classified as critical. This affects an unknown part