{"id":"CVE-2019-14322","aliases":["GHSA-j544-7q9p-6xp8","PYSEC-2026-1065"],"title":"Pallets Werkzeug vulnerable to Path Traversal","summary":"Pallets Werkzeug vulnerable to Path Traversal","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendor":"werkzeug","product":"werkzeug","ecosystem":"pip","affected":["werkzeug < 0.15.5"],"patched":["werkzeug 0.15.5"],"published":"2022-05-24","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-j544-7q9p-6xp8","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14322"},{"url":"https://github.com/pallets/werkzeug"},{"url":"https://palletsprojects.com/blog/werkzeug-0-15-5-released"},{"url":"http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html"}],"tags":["osv","pip","exploit-available"],"epss":0.55803,"epssPercentile":0.99023,"exploitAvailable":true,"ingestedAt":"2026-07-08T18:25:50.578Z","exploits":{"exploitdb":true,"github":3,"githubRepos":["https://github.com/faisalfs10x/CVE-2019-14322-scanner","https://github.com/faisalfs10x/http-vuln-cve2019-14322.nse","https://github.com/sergiovks/CVE-2019-14322"],"nuclei":["CVE-2019-14322"],"checkedAt":"2026-09-21T15:24:39.662Z"},"slug":"CVE-2019-14322","body":"## Overview\n\nIn Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.\n\n## Affected packages\n\n- `werkzeug < 0.15.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `werkzeug 0.15.5`","depth":"midnight","depthScore":64,"depthScoreParts":{"impact":41.3,"likelihood":11.2,"exploitation":12,"ransomware":0},"changes":[]}