PT-2024-33676 · Python+2 · Python+2

Nvn1729 · Published 2024-10-25 · Updated 2026-03-26 · CVE-2024-49766

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Werkzeug versions prior to 3.0.6

Description: The issue arises from the os.path.isabs() function not correctly handling UNC paths like //server/share on Python versions less than 3.11 on Windows. This affects Werkzeug's safe join() function, which relies on this check, potentially leading to unintended access to data. Applications using Python 3.11 or later, or those not running on Windows, are not affected.

Recommendations: For Werkzeug versions prior to 3.0.6, update to version 3.0.6 to resolve the issue. As a temporary workaround, consider avoiding the use of UNC paths like //server/share in applications using affected versions of Werkzeug until the patch is applied.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2025-3304

CVE-2024-49766

GHSA-F9VJ-2WH5-FJ8J

Affected Products

Alt Linux

Python

Werkzeug

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49766.json · Exploit
• https://github.com/pallets/werkzeug/security/advisories/GHSA-f9vj-2wh5-fj8j · Vendor Advisory
• https://github.com/pallets/werkzeug/commit/2767bcb10a7dd1c297d812cc5e6d11a474c1f092 · Patch
• https://osv.dev/vulnerability/CVE-2024-49766 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49766 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2024-49766 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-49766 · Security Note
• https://osv.dev/vulnerability/GHSA-f9vj-2wh5-fj8j · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-49766 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-49766 · Vendor Advisory
• https://github.com/pallets/werkzeug/releases/tag/3.0.6 · Note
• https://github.com/pallets/werkzeug · Note
• https://github.com/pallets/werkzeug/commit/87cc78a25f782f8c59fbde786840a00cf0d09b3d · Note
• https://reddit.com/r/AgentZero/comments/1s4m9gy/devs_close_your_security_holes_this_app_is · Reddit Post
• https://security.netapp.com/advisory/ntap-20250131-0005 · Note