werkzeug

6 results · Clear filters · Feed

• Medium 6.3
  CVE-2026-102598

  Werkzeug safe_join() allows Windows special device names

  Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker.…

  pallets werkzeug tensorflow python-tensorboard Ubuntu Azure Linux Wolfi PyPI
  Sep 29, 2026
• Medium 6.3
  CVE-2026-27199 Public exploit

  Werkzeug safe_join() allows Windows special device names

  Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filterin…

  pallets werkzeug open-webui airflow-3 Alpine Wolfi PyPI
  Feb 21, 2026
• Medium 6.3
  CVE-2026-21860

  Werkzeug safe_join() allows Windows special device names with compound extensions

  Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON…

  pallets werkzeug werkzeug py3-werkzeug Alpine PyPI
  Jan 8, 2026
• Medium 6.3
  CVE-2025-66221

  Werkzeug safe_join() allows Windows special device names

  Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and re…

  pallets werkzeug werkzeug py3-werkzeug Alpine PyPI
  Nov 29, 2025
• Medium 6.9
  CVE-2024-49767

  Werkzeug possible resource exhaustion when parsing file data in forms

  Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding to a version of Werkzeug prior to 3.0.6 to parse `multipart/form-data` requests (e.g. all flask applications) are vulner…

  pallets werkzeug Quart airflow-3 Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Oct 25, 2024
• Medium 6.3
  CVE-2024-49766

  Werkzeug safe_join not safe on Windows

  Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially…

  pallets werkzeug airflow-3 kubeflow-pipelines-visualization-server Wolfi PyPI
  Oct 25, 2024