CVE-2026-27199Medium▾ TwilightPoC availableWerkzeug safe_join() allows Windows special device names
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 27.5 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.6%
1 GitHub repo
Last analysed / modified upstream
0.6% → 0.6%
Werkzeug's safe_join function allows Windows device names as filenames if when preceded by other path segments.
This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL.
send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.
werkzeug < 3.1.6Upgrade to a patched release:
werkzeug 3.1.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-46136Medium· 5.7Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
CVE-2019-14322High· 7.5Pallets Werkzeug vulnerable to Path Traversal
CVE-2024-34069High· 7.5Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
CVE-2023-25577High· 7.5High resource usage when parsing multipart form data with many fields
CVE-2023-23934Low· 2.6Incorrect parsing of nameless cookies leads to __Host- cookies bypass
CVE-2024-49767High· 7.5Werkzeug possible resource exhaustion when parsing file data in forms