CVE-2026-39844

@@ -3,7 +3,7 @@
 from collections.abc import AsyncIterator
 from dataclasses import dataclass
 from io import BytesIO
-from pathlib import Path, PurePosixPath
+from pathlib import Path
 
 import aiofiles
 import anyio
@@ -149,8 +149,13 @@ async def create_file_upload(upload: UploadFile, *, chunk_size: int = 1024 * 102
         if temp_file:
             await temp_file.close()
 
-    filename = PurePosixPath(upload.filename or '').name  # strips all path components
+    filename = _sanitize_filename(upload.filename)
     if temp_file:
         return LargeFileUpload(filename, upload.content_type or '', Path(str(temp_file.name)))
     else:
         return SmallFileUpload(filename, upload.content_type or '', buffer.getvalue())
+
+
+def _sanitize_filename(name: str | None) -> str:
+    """Strip all path components from a filename to prevent path traversal."""
+    return (name or '').rsplit('/')[-1].rsplit('\\')[-1]

@@ -3,6 +3,7 @@
 import pytest
 
 from nicegui import events, ui
+from nicegui.elements.upload_files import _sanitize_filename
 from nicegui.testing import Screen
 
 test_path1 = Path('tests/test_upload.py').resolve()
@@ -163,3 +164,15 @@ def page():
     screen.wait(0.1)
     assert reads[0].file.size() == size
     assert await reads[0].file.text() == tmp_file.read_text()
+
+
+@pytest.mark.parametrize('input_name,expected', [
+    ('simple.txt', 'simple.txt'),
+    ('../../etc/passwd', 'passwd'),
+    ('..\\..\\windows\\evil.exe', 'evil.exe'),
+    ('../..\\..\\mixed/traversal\\payload.txt', 'payload.txt'),
+    ('', ''),
+    (None, ''),
+])
+def test_upload_filename_sanitization(input_name: str | None, expected: str):
+    assert _sanitize_filename(input_name) == expected