CVE-2024-32005

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-32005
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32005.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-32005
Aliases
Published
2024-04-12T20:38:51Z
Modified
2026-08-12T03:51:14Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L CVSS Calculator
Summary
Local File Inclusion in NiceGUI leaflet component
Details

NiceGUI is an easy-to-use, Python-based UI framework. A local file inclusion is present in the NiceUI leaflet component when requesting resource files under the /_nicegui/{__version__}/resources/{key}/{path:path} route. As a result any file on the backend filesystem which the web server has access to can be read by an attacker with access to the NiceUI leaflet website. This vulnerability has been addressed in version 1.4.21. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-23"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32005.json"
}
References

Affected packages

Git / github.com/zauberzeug/nicegui

Affected ranges

Type
GIT
Repo
https://github.com/zauberzeug/nicegui
Events
Introduced
ce8ee3ccf0becfc707abab63cd3a3ce951aa59b1
Fixed
ed12eb14f2a6c48b388a05c04b3c5a107ea9d330
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.4.6"
        },
        {
            "fixed": "1.4.21"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.4.10
v1.4.11
v1.4.12
v1.4.13
v1.4.14
v1.4.15
v1.4.16
v1.4.17
v1.4.18
v1.4.19
v1.4.20
v1.4.6
v1.4.7
v1.4.8
v1.4.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-32005.json"