CVE-2026-27199

Katalog CVE

CVSS 5.3 · Medium EPSS 0,56%

Kerentanan Improper Handling of Windows Device Names pada palletsprojects werkzeug. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.

Rincian

Terbit di NVD

21 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-67: Improper Handling of Windows Device Names

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 44,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pallets/werkzeug/security/advisories/GHSA-29vq-49wr-vm6x advisory vendor
• https://github.com/pallets/werkzeug/commit/f407712fdc60a09c2b3f4fe7db557703e5d9338d patch
• https://github.com/pallets/werkzeug/releases/tag/3.1.6 release notes