Skip to content
OpenAdvisories

Weakness (CWE)

CWE-67: Improper Handling of Windows Device Names

Variant Incomplete

The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.

How to prevent it (1 mitigation)

  1. Implementation

    Be familiar with the device names in the operating system where your system is deployed. Check input for these device names.

Source: MITRE CWE-67

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.3
    CVE-2026-27199 Public exploit

    Werkzeug safe_join() allows Windows special device names

    Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filterin…

    pallets werkzeug werkzeug py3-werkzeug Alpine PyPI