NiceGUI versions before 3.10.0 are vulnerable to a path traversal attack (CWE-22) due to improper limitation of pathname to a restricted directory. The sanitization relies on PurePosixPath which only recognizes forward slashes, enabling attackers on Windows to use backslashes in filenames to bypass checks. This allows arbitrary file writes when the application constructs file paths from the uploaded file's name. The vulnerability is resolved in NiceGUI 3.10.0.

An attacker can exploit this vulnerability on Windows systems to write arbitrary files outside the intended directory by uploading files with specially crafted filenames containing backslashes. This can lead to unauthorized modification of files, potentially impacting the integrity of the system or application data. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

This vulnerability is fixed in NiceGUI version 3.10.0. Users should upgrade to version 3.10.0 or later to remediate the issue. Since no official patch link or advisory is provided, verify the upgrade availability from the vendor's official sources. Patch status is not explicitly confirmed beyond the fix in 3.10.0, so check vendor advisories for the latest remediation guidance.