PT-2026-2107 · Werkzeug · Werkzeug

Yueyuel · Published 2026-01-08 · Updated 2026-05-20 · CVE-2026-21860

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 3.1.5

Description Werkzeug’s safe join function improperly handles path segments containing Windows device names with file extensions or trailing spaces. Windows device names, such as CON and AUX, are implicitly present and readable in every directory and are accepted with file extensions (e.g., CON.txt) or trailing spaces (e.g., CON ). This can lead to unauthorized access or manipulation of system resources.

Recommendations Update Werkzeug to version 3.1.5 or later.

Exploit

Fix

Weakness Enumeration

CWE-67

Related Identifiers

CVE-2026-21860

GHSA-87HC-H4R5-73F7

Affected Products

Werkzeug

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21860.json · Exploit
• https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7 · Vendor Advisory
• https://github.com/pallets/werkzeug/commit/7ae1d254e04a0c33e241ac1cca4783ce6c875ca3 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-21860 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-21860 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-87hc-h4r5-73f7 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-21860 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21860 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21860 · Security Note
• https://ubuntu.com/security/CVE-2026-21860 · Vendor Advisory
• https://github.com/pallets/werkzeug · Note
• https://t.me/CVEtracker/41759 · Telegram Post
• https://t.me/msrcreports/3204 · Telegram Post
• https://twitter.com/CVEnew/status/2009462338295091494 · Twitter Post