Executive Summary

CVE-2026-27199 is a security vulnerability in the Werkzeug web application library affecting versions 3.1.5 and below. The issue lies in the safe_join function, which is intended to safely combine user-supplied path segments with a base directory. On Windows systems, safe_join allowed special device names (such as NUL, CON, PRN, AUX, COM1, LPT1, etc.) to appear as filenames if they were preceded by other path segments (e.g., example/NUL). This improper handling could lead to the application opening these special device files, causing the reading operation to hang indefinitely.

The vulnerability arises because the filtering in safe_join did not account for multi-segment paths containing these special device names. This flaw could potentially be exploited to cause denial of service or unexpected behavior when serving files. The issue was fixed in Werkzeug version 3.1.6 by enhancing safe_join to reject any multi-segment path containing Windows special device names.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact applications running Werkzeug on Windows by allowing specially crafted file paths containing Windows device names to be processed incorrectly. When such a path is requested, the application may open a special device file, causing the reading operation to hang indefinitely. This can lead to denial of service conditions where the application becomes unresponsive or stuck handling these requests.

Additionally, the improper handling of special device names in file paths could potentially be exploited for unauthorized file access or path traversal attacks, depending on the application context. This could compromise the security and stability of the affected web application.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability involves the Werkzeug library's safe_join function improperly handling Windows special device names in multi-segment paths, which can cause file reads to hang indefinitely if exploited."}, {'type': 'paragraph', 'content': 'To detect this vulnerability on your system, you should check the version of Werkzeug in use. Versions 3.1.5 and below are vulnerable, while version 3.1.6 includes the fix.'}, {'type': 'paragraph', 'content': 'On a Windows system, you can check the Werkzeug version installed in your Python environment by running the following command:'}, {'type': 'list_item', 'content': 'python -m pip show werkzeug'}, {'type': 'paragraph', 'content': 'Additionally, to detect if the vulnerable code is being triggered, you can monitor for requests or logs where paths include Windows special device names such as NUL, CON, PRN, AUX, COM1-COM9, LPT1-LPT9, especially in multi-segment paths (e.g., example/NUL).'}, {'type': 'paragraph', 'content': 'Since the vulnerability causes the application to hang indefinitely when reading such files, monitoring for hanging or stalled requests in your web application logs or network traffic could also indicate exploitation attempts.'}] [1, 2]

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Werkzeug to version 3.1.6 or later, where the safe_join function has been fixed to reject Windows special device names in multi-segment paths.

If upgrading immediately is not possible, consider implementing input validation on user-supplied paths to reject or sanitize any paths containing Windows special device names or suspicious multi-segment paths.

Additionally, monitor your application for any hanging or stalled file read operations that could indicate exploitation attempts.

Useful 0 Not Useful 0