PT-2025-48363 · Werkzeug · Werkzeug

Published 2025-11-29 · Updated 2026-05-20 · CVE-2025-66221

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 3.1.4

Description The safe join function in Werkzeug versions prior to 3.1.4 improperly handles path segments containing Windows device names. On Windows systems, special device names like CON and AUX are present in every directory. The send from directory function utilizes safe join to serve files from user-specified paths. When a request path includes a Windows device name, file opening succeeds, but reading the file will cause the application to hang indefinitely. This occurs because the operating system attempts to access a device rather than a regular file.

Recommendations Update to Werkzeug version 3.1.4 or later.

Exploit

Fix

Weakness Enumeration

CWE-67

Related Identifiers

CVE-2025-66221

ECHO-7D05-D296-CA8F

GHSA-HGF8-39GV-G3F2

OPENSUSE-SU-2025:15848-1

Affected Products

Werkzeug

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66221.json · Exploit
• https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2 · Vendor Advisory
• https://github.com/pallets/werkzeug/commit/4b833376a45c323a189cd11d2362bcffdb1c0c13 · Patch
• https://osv.dev/vulnerability/GHSA-hgf8-39gv-g3f2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15848-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66221 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-66221 · Vendor Advisory
• https://github.com/pallets/werkzeug · Note
• https://github.com/pallets/werkzeug/releases/tag/3.1.4 · Note
• https://t.me/msrcreports/2300 · Telegram Post
• https://twitter.com/kernyx64/status/1998441293786038705 · Twitter Post
• https://t.me/CVEtracker/38463 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1994613200684253561 · Twitter Post
• https://suse.com/security/cve/CVE-2025-66221 · Note