CVE-2024-49766: palletsprojects werkzeug

csirt@kutim:~/threat-intel/cve/CVE-2024-49766

CVSS 5.3 · Medium EPSS 0,78%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada palletsprojects werkzeug. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.

Rincian

Terbit di NVD: 25 Oktober 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 0,78% peluang dieksploitasi; lebih tinggi dari 54,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
palletsprojects	werkzeug	Semua versi sebelum 3.0.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/pallets/werkzeug/security/advisories/GHSA-f9vj-2wh5-fj8j advisory vendor
https://github.com/pallets/werkzeug/commit/2767bcb10a7dd1c297d812cc5e6d11a474c1f092 patch
https://security.netapp.com/advisory/ntap-20250131-0005/ advisory pihak ketiga
https://github.com/pallets/werkzeug/releases/tag/3.0.6 release notes

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.