PT-2026-2107 · Werkzeug · Werkzeug

Yueyuel · CVE-2026-21860 · Published 2026-01-08 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 3.1.5

Description Werkzeug’s safe join function improperly handles path segments containing Windows device names with file extensions or trailing spaces. Windows device names, such as CON and AUX, are implicitly present and readable in every directory and are accepted with file extensions (e.g., CON.txt) or trailing spaces (e.g., CON ). This can lead to unauthorized access or manipulation of system resources.

Recommendations Update Werkzeug to version 3.1.5 or later.

Exploit

Fix

Weakness Enumeration

CWE-67

Related Identifiers

CLEANSTART-2026-AZ09261

CLEANSTART-2026-HP19968

CLEANSTART-2026-IR98353

CLEANSTART-2026-MR94452

CLEANSTART-2026-NL78203

CLEANSTART-2026-WQ85001

CLEANSTART-2026-WU03167

CVE-2026-21860

GHSA-87HC-H4R5-73F7

PYSEC-2026-2044

Affected Products

Werkzeug

References · 199

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21860.json · Exploit
• https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7 · Vendor Advisory
• https://github.com/pallets/werkzeug/commit/7ae1d254e04a0c33e241ac1cca4783ce6c875ca3 · Patch
• https://osv.dev/vulnerability/CLEANSTART-2026-AZ09261 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-NL78203 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-26007 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45186 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62727 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-49766 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25645 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-48710 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-34069 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31958 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-0994 · Security Note