Skip to content
OpenAdvisories
Medium · 6.3 Public exploit CVE-2026-27199 EUVD-2026-7732GHSA-29vq-49wr-vm6xPYSEC-2026-2320

Werkzeug safe_join() allows Windows special device names

Published Feb 21, 2026 · Updated Feb 24, 2026 · Assigned by GitHub_M

Vendor: pallets Product: werkzeug Package: airflow-3 Package: kubeflow-pipelines-visualization-server Package: kubeflow-volumes-web-app Package: open-webui Package: py3-werkzeug Package: py3.10-ambassador Package: py3.11-ambassador Package: py3.12-ambassador Package: py3.13-ambassador Package: superset-6.0 Package: werkzeug Ecosystem: Alpine Ecosystem: PyPI Ecosystem: Wolfi

Description

Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.

Affected products

VendorProductAffectedFixed
pallets werkzeug < 3.1.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 py3-werkzeug 3.1.6-r0 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling airflow-3 3.2.0-r0 —
Wolfi rolling kubeflow-pipelines-visualization-server 2.16.0-r1 —
Wolfi rolling kubeflow-volumes-web-app 1.10.0-r11 —
Wolfi rolling open-webui 0.8.3-r1 —
Wolfi rolling py3.10-ambassador +3 3.10.0-r20 —
Wolfi rolling superset-6.0 6.0.0-r3 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI werkzeug < 3.1.6 3.1.6 GHSA-29vq-49wr-vm6x

Advisories 1

References