{"id":"CVE-2026-27199","aliases":["GHSA-29vq-49wr-vm6x","PYSEC-2026-2320"],"url":"https://o3.security/vulnerability/CVE-2026-27199","summary":"Werkzeug safe_join() allows Windows special device names","details":"Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.","published":"2026-02-21T05:15:53.335Z","modified":"2026-08-12T03:51:37.101354486Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"werkzeug","fixedVersion":"3.1.6"}],"fix":{"url":"https://github.com/pallets/werkzeug/commit/f407712fdc60a09c2b3f4fe7db557703e5d9338d","label":"pallets/werkzeug@f407712"},"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/releases/tag/3.1.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27199.json"},{"type":"ADVISORY","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-29vq-49wr-vm6x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27199"},{"type":"FIX","url":"https://github.com/pallets/werkzeug/commit/f407712fdc60a09c2b3f4fe7db557703e5d9338d"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:37.101354486Z"}}