PT-2025-48363 · Werkzeug · Werkzeug

Published 2025-11-29 · Updated 2025-11-29 · CVE-2025-66221

Positive Technologies · (AI Summary)

CVSS v4.0

6.3

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 3.1.4

Description The

safe join

function in Werkzeug versions prior to 3.1.4 improperly handles path segments containing Windows device names. On Windows systems, special device names like CON and AUX are present in every directory. The

send from directory

function utilizes

safe join

to serve files from user-specified paths. When a request path includes a Windows device name, file opening succeeds, but reading the file will cause the application to hang indefinitely. This occurs because the operating system attempts to access a device rather than a regular file.

Recommendations Update to Werkzeug version 3.1.4 or later.

Fix

Weakness Enumeration

CWE-67

Related Identifiers

CVE-2025-66221

GHSA-HGF8-39GV-G3F2

Affected Products

Werkzeug

References · 7

• https://osv.dev/vulnerability/CVE-2025-66221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66221 · Security Note
• https://github.com/pallets/werkzeug/releases/tag/3.1.4 · Note
• https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2 · Note
• https://github.com/pallets/werkzeug/commit/4b833376a45c323a189cd11d2362bcffdb1c0c13 · Note
• https://t.me/CVEtracker/38463 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1994613200684253561 · Twitter Post