Description
Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pallets | werkzeug | < 3.0.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow +1 | No fix yet | — |
| Wolfi rolling | airflow-3 | 3.2.0-r0 | — |
| Wolfi rolling | emissary +6 | 3.9.1-r4 | — |
| Wolfi rolling | kubeflow-jupyter-web-app +1 | 1.9.2-r1 | — |
| Wolfi rolling | kubeflow-pipelines-visualization-server | 2.4.0-r0 | — |
| Wolfi rolling | py3-werkzeug | 3.0.6-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | werkzeug | < 3.0.6 | 3.0.6 | GHSA-f9vj-2wh5-fj8j |
Advisories 3
- WID-SEC-2025-0148 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025
- WID-SEC-2024-3614 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 4, 2024