Werkzeug safe_join() allows Windows special device names
GHSA-29vq-49wr-vm6x · CVE-2026-27199 · PYSEC-2026-2320
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Werkzeug's safe_join function allows Windows device names as filenames if when preceded by other path segments.
This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL.
send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.
References
- WEB https://github.com/pallets/werkzeug/security/advisories/GHSA-29vq-49wr-vm6x
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-27199
- WEB https://github.com/pallets/werkzeug/commit/f407712fdc60a09c2b3f4fe7db557703e5d9338d
- PACKAGE https://github.com/pallets/werkzeug
- WEB https://github.com/pallets/werkzeug/releases/tag/3.1.6
Ready to move
Start Securing
Free, no credit card | First findings in minutes