CVE-2026-45554

NiceGUI denial-of-service via log amplification in static asset routes.

• CVSS 5.3
• CWE-248
• Resource Management
• Remote

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. This issue has been patched in version 3.12.0.

CVE

CVE-2026-45554

CWE

CWE-248

CVSS base score

5.3

Published

2026-06-02

OWASP

A09 Security Logging and Monitoring Failures

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Resource Management

Subcategory

Resource Exhaustion

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

NiceGUI

Fixed by upgrading

Yes

Solution

Upgrade NiceGUI to version 3.12.0 or later.

import os
from fastapi import FastAPI
from starlette.responses import FileResponse

# This code represents the vulnerable pattern.
# To run:
# 1. pip install fastapi "uvicorn[standard]"
# 2. uvicorn this_script_name:app
# 3. Access http://127.0.0.1:8000/_nicegui/assets/a_directory
# 4. Observe the RuntimeError traceback in the server log.

app = FastAPI()

# Setup a temporary directory structure for the demonstration
STATIC_DIR = "temp_static_assets"
if not os.path.exists(STATIC_DIR):
    os.makedirs(os.path.join(STATIC_DIR, "a_directory"))
with open(os.path.join(STATIC_DIR, "a_file.txt"), "w") as f:
    f.write("some file content")


@app.get("/_nicegui/assets/{path:path}")
async def serve_assets(path: str):
    """
    This route is vulnerable because it does not validate that the
    requested path is a file. It blindly passes the path to FileResponse.
    """
    file_path = os.path.join(STATIC_DIR, path)

    # The vulnerability: If `file_path` is a directory, FileResponse
    # raises an unhandled RuntimeError, causing a full traceback in the logs.
    return FileResponse(file_path)

from pathlib import Path
from fastapi import HTTPException
from starlette.responses import FileResponse

def create_safe_file_response(path: Path) -> FileResponse:
    """
    Safely creates a FileResponse, representing the fix for CVE-2023-45554.
    
    The vulnerable code would pass a path directly to FileResponse. If the path
    was a directory, it would cause an unhandled RuntimeError.

    The fix is to check if the path is a file before attempting to serve it.
    If it's not a file (e.g., it's a directory or does not exist), a
    controlled HTTPException is raised instead of causing a server error.
    """
    if not path.is_file():
        raise HTTPException(status_code=404, detail="File not found")
    
    return FileResponse(path)

/_nicegui/static/..

@misc{vaitp:cve202645554,
  title        = {{NiceGUI denial-of-service via log amplification in static asset routes.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-45554},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-45554/}}
}