CVE-2025-66221Medium▾ SunlitWerkzeug safe_join() allows Windows special device names
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.5%
0.5% → 0.5%
Last analysed / modified upstream
Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.
werkzeug < 3.1.4Upgrade to a patched release:
werkzeug 3.1.4Connected by shared product, vendor, weakness, or advisory.
CVE-2023-25577High· 7.5High resource usage when parsing multipart form data with many fields
CVE-2023-23934Low· 2.6Incorrect parsing of nameless cookies leads to __Host- cookies bypass
CVE-2023-46136Medium· 5.7Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
CVE-2026-27199MediumWerkzeug safe_join() allows Windows special device names
CVE-2024-49767High· 7.5Werkzeug possible resource exhaustion when parsing file data in forms
CVE-2019-14322High· 7.5Pallets Werkzeug vulnerable to Path Traversal