{"id":"CVE-2024-49766","aliases":["GHSA-f9vj-2wh5-fj8j","PYSEC-2026-2045"],"title":"Werkzeug safe_join not safe on Windows","summary":"Werkzeug safe_join not safe on Windows","severity":"medium","vendor":"werkzeug","product":"werkzeug","ecosystem":"pip","affected":["werkzeug < 3.0.6"],"patched":["werkzeug 3.0.6"],"published":"2024-10-25","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:19.894904779Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-f9vj-2wh5-fj8j","references":[{"url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-f9vj-2wh5-fj8j"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49766"},{"url":"https://github.com/pallets/werkzeug/commit/2767bcb10a7dd1c297d812cc5e6d11a474c1f092"},{"url":"https://github.com/pallets/werkzeug"},{"url":"https://github.com/pallets/werkzeug/releases/tag/3.0.6"},{"url":"https://security.netapp.com/advisory/ntap-20250131-0005"}],"tags":["osv","pip"],"epss":0.00776,"epssPercentile":0.53858,"ingestedAt":"2026-07-08T18:25:48.855Z","slug":"CVE-2024-49766","body":"## Overview\n\nOn Python < 3.11 on Windows, `os.path.isabs()` does not catch UNC paths like `//server/share`. Werkzeug's `safe_join()` relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable.\n\n## Affected packages\n\n- `werkzeug < 3.0.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `werkzeug 3.0.6`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}