CVE-2026-45553: NiceGUI: Local file disclosure via Docutils file insertion in ui.restructured_text()

Synopsis

This is a local file disclosure vulnerability in NiceGUI, a Python-based UI framework. The flaw is reachable over the network with no authentication required, affecting any NiceGUI application that passes attacker-controlled input to the ui.restructured_text() function. Successful exploitation lets an attacker read arbitrary local files accessible to the NiceGUI server process, including configuration files, credentials, or application secrets. No fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as an upstream fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable rendering function is served over the network; an attacker must be able to reach the NiceGUI application endpoint to submit malicious reStructuredText content.

• AuthenticationNot required

  No credentials or session token are needed; the attacker only needs to reach the application and supply attacker-controlled input to the affected function.

• Victim interactionNot required

  No user action is required; the attacker submits the malicious directive directly to the server-side rendering path without any victim involvement.

• Attack complexityDetail

  Exploit complexity is low: the attack uses standard, documented Docutils directives and requires no special timing, race conditions, or environmental setup.

Blast Radius

• Reads arbitrary local files that the NiceGUI server process has permission to open, including environment files, application configuration, and on-disk secrets such as API keys or database passwords.
• Reads files outside the application directory if the OS user running the server has broader filesystem access, for example /etc/passwd or mounted secret volumes in a container.
• Exposes any credentials or tokens embedded in files, which an attacker can use to pivot to other services or authentication systems.