CVE-2024-32005 - CVE House

Back to Database

Status published High CVE-2024-32005

Local File Inclusion in NiceGUI leaflet component

8.2 CVSS

Vulnerability Description

NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the `/_nicegui/{__version__}/resources/{key}/{path:path}` route. As a result any file on the backend filesystem which the web server has access to can be read by an attacker with access to the NiceUI leaflet website. This vulnerability has been addressed in version 1.4.21. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-32005

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from zauberzeug

View All →

NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading

NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection

NiceGUI is vulnerable to Reflected XSS attack

NiceGUI On Air authentication issue

Affected Vendor

zauberzeug

View all reports →

Affected Software

nicegui

Vulnerable Versions:

>= 1.4.6, < 1.4.21

Timeline

Official Publish: April 12th, 2024

Last Modified: September 6th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1105 Ingress Tool Transfer

Command and Control

T1565 Data Manipulation

T1565.001 Stored Data Manipulation