Read the docs
TI-2026-21636 Aliases CVE-2026-27199GHSA-29vq-49wr-vm6x

Werkzeug safe_join() allows Windows special device names

Priority LOW 29CWE-67Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00631 50th percentileScored 2026-11-07
Fix Fixed werkzeug (pallets): 3.1.6werkzeug (PyPI): 3.1.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
palletswerkzeugbefore 3.1.63.1.6Patch availableCNA
—werkzeug (PyPI)before 3.1.63.1.6Patch availableGHSA-29vq-49wr-vm6x
  • werkzeug Vendorpallets Affected before 3.1.6 Fixed in 3.1.6 Patch available CNA
  • werkzeug (PyPI) Vendor— Affected before 3.1.6 Fixed in 3.1.6 Patch available GHSA-29vq-49wr-vm6x

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*before 3.1.6Vulnerablepallets
  • cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:* Versions before 3.1.6 Vulnerable ·pallets

Remediation

  • Fix · CNA werkzeug (pallets) Fixed in 3.1.6
  • Fix · GHSA-29vq-49wr-vm6x werkzeug (PyPI) Fixed in 3.1.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-27199
  2. 2026-10-03 Alias added: GHSA-29vq-49wr-vm6x
  3. 2026-10-27 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 2

  • TI-2019-10671 In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames. CVSS 3.1HIGH 7.5
  • TI-2022-11856 Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers… CVSS 3.1CRITICAL 9.8
  • TI-2023-10880 Werkzeug may allow high resource usage when parsing multipart form data with many fields CVSS 3.1HIGH 7.5
  • TI-2024-22527 Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution CVSS 3.1HIGH 7.5
  • TI-2024-33234 Werkzeug possible resource exhaustion when parsing file data in forms CVSS 4.0MEDIUM 6.9
  • TI-2023-24778 Uncontrolled resource consumption in pallets werkzeug CVSS 3.1HIGH 8.0
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences