Log in Start free

Vulnerability · Published Sep 29, 2026 · Assigned by GitHub_M

CVE-2026-102598Werkzeug safe_join() allows Windows special device names

Medium 6.3

In plain English

A medium-severity security flaw in werkzeug from pallets. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.4%top 68.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs on Windows with NTFS and serves a user-specified path ending in a special device name such as NUL:. The attack mechanism is that a requested path ends in a Windows special device name with an empty ADS marker. The impact is that the special device opens successfully and the file read hangs indefinitely. This issue is fixed in version 3.1.9.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIwerkzeug3.1.9GHSA-g6x2-hccm-hh4m
PyPIwerkzeug3.1.9PYSEC-2026-4312
Ubuntu:22.04:LTSpython-werkzeugno fix listedUBUNTU-CVE-2026-102598
Ubuntu:24.04:LTSpython-werkzeugno fix listedUBUNTU-CVE-2026-102598
Ubuntu:26.04:LTSpython-werkzeugno fix listedUBUNTU-CVE-2026-102598
Ubuntu:26.10python-werkzeugno fix listedUBUNTU-CVE-2026-102598

Affected products (as reported)

VendorProductVersions
pallets werkzeug < 3.1.9

Weakness: CWE-67 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References