---
id: CVE-2019-14322
aliases:
  - GHSA-j544-7q9p-6xp8
  - PYSEC-2026-1065
title: Pallets Werkzeug vulnerable to Path Traversal
summary: Pallets Werkzeug vulnerable to Path Traversal
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: werkzeug
product: werkzeug
ecosystem: pip
affected:
  - werkzeug < 0.15.5
patched:
  - werkzeug 0.15.5
published: '2022-05-24'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-j544-7q9p-6xp8'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-14322'
  - url: 'https://github.com/pallets/werkzeug'
  - url: 'https://palletsprojects.com/blog/werkzeug-0-15-5-released'
  - url: >-
      http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html
tags:
  - osv
  - pip
  - exploit-available
epss: 0.55803
epssPercentile: 0.98998
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:50.578Z'
exploits:
  exploitdb: true
  github: 3
  githubRepos:
    - 'https://github.com/faisalfs10x/CVE-2019-14322-scanner'
    - 'https://github.com/faisalfs10x/http-vuln-cve2019-14322.nse'
    - 'https://github.com/sergiovks/CVE-2019-14322'
  nuclei:
    - CVE-2019-14322
  checkedAt: '2026-09-24T07:52:48.775Z'
---

## Overview

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

## Affected packages

- `werkzeug < 0.15.5`

## Remediation

Upgrade to a patched release:

- `werkzeug 0.15.5`