CVE-2026-27199
Path Traversal in Werkzeug safe_join Causes Windows Hang
Publication date: 2026-02-21
Last updated on: 2026-03-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| palletsprojects | werkzeug | to 3.1.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-67 | The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-27199 is a security vulnerability in the Werkzeug web application library affecting versions 3.1.5 and below. The issue lies in the safe_join function, which is intended to safely combine user-supplied path segments with a base directory. On Windows systems, safe_join allowed special device names (such as NUL, CON, PRN, AUX, COM1, LPT1, etc.) to appear as filenames if they were preceded by other path segments (e.g., example/NUL). This improper handling could lead to the application opening these special device files, causing the reading operation to hang indefinitely.
The vulnerability arises because the filtering in safe_join did not account for multi-segment paths containing these special device names. This flaw could potentially be exploited to cause denial of service or unexpected behavior when serving files. The issue was fixed in Werkzeug version 3.1.6 by enhancing safe_join to reject any multi-segment path containing Windows special device names.
How can this vulnerability impact me? :
This vulnerability can impact applications running Werkzeug on Windows by allowing specially crafted file paths containing Windows device names to be processed incorrectly. When such a path is requested, the application may open a special device file, causing the reading operation to hang indefinitely. This can lead to denial of service conditions where the application becomes unresponsive or stuck handling these requests.
Additionally, the improper handling of special device names in file paths could potentially be exploited for unauthorized file access or path traversal attacks, depending on the application context. This could compromise the security and stability of the affected web application.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability involves the Werkzeug library's safe_join function improperly handling Windows special device names in multi-segment paths, which can cause file reads to hang indefinitely if exploited."}, {'type': 'paragraph', 'content': 'To detect this vulnerability on your system, you should check the version of Werkzeug in use. Versions 3.1.5 and below are vulnerable, while version 3.1.6 includes the fix.'}, {'type': 'paragraph', 'content': 'On a Windows system, you can check the Werkzeug version installed in your Python environment by running the following command:'}, {'type': 'list_item', 'content': 'python -m pip show werkzeug'}, {'type': 'paragraph', 'content': 'Additionally, to detect if the vulnerable code is being triggered, you can monitor for requests or logs where paths include Windows special device names such as NUL, CON, PRN, AUX, COM1-COM9, LPT1-LPT9, especially in multi-segment paths (e.g., example/NUL).'}, {'type': 'paragraph', 'content': 'Since the vulnerability causes the application to hang indefinitely when reading such files, monitoring for hanging or stalled requests in your web application logs or network traffic could also indicate exploitation attempts.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade Werkzeug to version 3.1.6 or later, where the safe_join function has been fixed to reject Windows special device names in multi-segment paths.
If upgrading immediately is not possible, consider implementing input validation on user-supplied paths to reject or sanitize any paths containing Windows special device names or suspicious multi-segment paths.
Additionally, monitor your application for any hanging or stalled file read operations that could indicate exploitation attempts.