Read the docs
TI-2026-17562 Aliases CVE-2026-21860GHSA-87hc-h4r5-73f7

Werkzeug safe_join() allows Windows special device names with compound extensions

Priority LOW 29CWE-67Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00475 41st percentileScored 2026-11-07
Fix Fixed werkzeug (pallets): 3.1.5Werkzeug (PyPI): 3.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
palletswerkzeugbefore 3.1.53.1.5Patch availableCNA
—Werkzeug (PyPI)before 3.1.53.1.5Patch availableGHSA-87hc-h4r5-73f7
  • werkzeug Vendorpallets Affected before 3.1.5 Fixed in 3.1.5 Patch available CNA
  • Werkzeug (PyPI) Vendor— Affected before 3.1.5 Fixed in 3.1.5 Patch available GHSA-87hc-h4r5-73f7

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*before 3.1.5Vulnerablepallets
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:* Versions before 3.1.5 Vulnerable ·pallets
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA werkzeug (pallets) Fixed in 3.1.5
  • Fix · GHSA-87hc-h4r5-73f7 Werkzeug (PyPI) Fixed in 3.1.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-21860
  2. 2026-10-03 Alias added: GHSA-87hc-h4r5-73f7

References

Patch 1

Advisory 2

Other 1

  • TI-2019-10671 In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames. CVSS 3.1HIGH 7.5
  • TI-2022-11856 Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers… CVSS 3.1CRITICAL 9.8
  • TI-2023-10880 Werkzeug may allow high resource usage when parsing multipart form data with many fields CVSS 3.1HIGH 7.5
  • TI-2024-22527 Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution CVSS 3.1HIGH 7.5
  • TI-2024-33234 Werkzeug possible resource exhaustion when parsing file data in forms CVSS 4.0MEDIUM 6.9
  • TI-2023-24778 Uncontrolled resource consumption in pallets werkzeug CVSS 3.1HIGH 8.0
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences