PT-2026-21351 · Werkzeug · Werkzeug

Alimezar · Published 2026-02-19 · Updated 2026-05-20 · CVE-2026-27199

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Werkzeug versions 3.1.5 and below

Description The safe join function in Werkzeug, a WSGI web application library, improperly handles Windows device names when used as filenames, particularly when preceded by other path segments. Specifically, the function allows Windows device names as filenames, potentially leading to indefinite hanging when reading files if the application is running on Windows and the requested path ends with a special device name. The send from directory function utilizes safe join to serve files, making it susceptible to this issue.

Recommendations Update to Werkzeug version 3.1.6 or later.

Exploit

Fix

Weakness Enumeration

CWE-67

Related Identifiers

CVE-2026-27199

GHSA-29VQ-49WR-VM6X

Affected Products

Werkzeug

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27199.json · Exploit
• https://github.com/pallets/werkzeug/commit/f407712fdc60a09c2b3f4fe7db557703e5d9338d · Patch
• https://github.com/pallets/werkzeug/security/advisories/GHSA-29vq-49wr-vm6x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27199 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-27199 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-29vq-49wr-vm6x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27199 · Vendor Advisory
• https://github.com/pallets/werkzeug · Note
• https://github.com/pallets/werkzeug/releases/tag/3.1.6 · Note
• https://twitter.com/CVEnew/status/2025154190717108708 · Twitter Post
• https://t.me/cveNotify/152697 · Telegram Post
• https://t.me/CVEtracker/45350 · Telegram Post
• https://t.me/msrcreports/3228 · Telegram Post
• https://t.me/msrcreports/3297 · Telegram Post
• https://t.me/cveNotify/153997 · Telegram Post