Vulnerable code sample

from nicegui import ui
from pathlib import Path

# This code demonstrates the vulnerable application pattern described in CVE-2026-25732.
# It simulates an application using a NiceGUI version prior to 3.7.0.
# The vulnerability is triggered by using the unsanitized `e.name` to construct a file path.

# Define a directory where uploads are intended to be stored.
UPLOAD_DIR = Path('uploads')
UPLOAD_DIR.mkdir(exist_ok=True)

def handle_upload(e):
    """
    A vulnerable file upload handler.
    An attacker can upload a file with a malicious name (e.g., '../../pwned.txt')
    to write files outside of the intended UPLOAD_DIR.
    """
    # VULNERABILITY: e.name contains the raw, unsanitized filename provided by the client.
    # In NiceGUI versions prior to 3.7.0, the framework does not clean this value.
    filename = e.name

    # VULNERABLE PATTERN: The unsanitized filename is directly joined with the base upload directory.
    # If `filename` is '../../pwned.txt', the `target_path` will resolve to a location
    # outside of the `UPLOAD_DIR`, leading to a path traversal vulnerability.
    target_path = UPLOAD_DIR / filename

    try:
        # The application code writes the uploaded content to the manipulated path.
        # This allows an attacker to place a file anywhere the application's user has
        # write permissions, potentially overwriting application source code, configuration,
        # or other critical files.
        with open(target_path, 'wb') as f:
            f.write(e.file.read())
        ui.notify(f'Uploaded "{filename}" to "{target_path}"', type='positive')
    except Exception as ex:
        ui.notify(f'Error uploading "{filename}": {ex}', type='negative')


# UI setup for the demonstration.
ui.label('Vulnerable File Upload (CVE-2026-25732 PoC)')
ui.markdown('To exploit, upload any file but rename it to `../../pwned.txt` in the browser\'s file selection dialog. '
            'This will create `pwned.txt` in the application\'s root directory, not in `./uploads`.')

# The `ui.upload` element is configured to use the vulnerable handler.
ui.upload(on_upload=handle_upload).props('label="Upload a maliciously named file"')

ui.run()