CVE-2019-14322

HIGH NUCLEI

Pallets Werkzeug <0.15.5 - Path Traversal

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2019-14322. PoCs published by faisalfs10x, sergiovks. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates a path traversal vulnerability in Pallets Werkzeug prior to 0.15.5 on Windows systems. It leverages the mishandling of drive names in Windows pathnames to access arbitrary files via SharedDataMiddleware.

Description

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Exploits (4)

exploitdb WORKING POC
by faisalfs10x · pythonwebappspython
https://www.exploit-db.com/exploits/50101

This exploit demonstrates a path traversal vulnerability in Pallets Werkzeug prior to 0.15.5 on Windows systems. It leverages the mishandling of drive names in Windows pathnames to access arbitrary files via SharedDataMiddleware.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Pallets Werkzeug < 0.15.5
No auth needed
Prerequisites: Target must be running a vulnerable version of Werkzeug on Windows · SharedDataMiddleware must be enabled
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC
by sergiovks · poc
https://github.com/sergiovks/CVE-2019-14322

This repository contains a functional exploit for CVE-2019-14322, a path traversal vulnerability in Pallets Werkzeug (affecting Odoo). The exploit sends crafted HTTP requests to read sensitive Windows files via the `SharedDataMiddleware` component.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Pallets Werkzeug < 0.15.5, Odoo (using vulnerable Werkzeug)
No auth needed
Prerequisites: Target running vulnerable Werkzeug/Odoo · Network access to the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER
by faisalfs10x · poc
https://github.com/faisalfs10x/http-vuln-cve2019-14322.nse

This repository contains an Nmap NSE script designed to detect CVE-2019-14322, a path traversal vulnerability in Pallets Werkzeug's SharedDataMiddleware on Windows systems. The script attempts to read `c:/windows/win.ini` as a proof of concept to confirm the vulnerability.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Pallets Werkzeug up to 0.15.4
No auth needed
Prerequisites: Target running a vulnerable version of Pallets Werkzeug on Windows · Network access to the target's HTTP/HTTPS service
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec SCANNER
by faisalfs10x · poc
https://github.com/faisalfs10x/CVE-2019-14322-scanner

This repository contains a Python script that scans for CVE-2019-14322, a directory traversal vulnerability in Pallets Werkzeug. The script checks for the presence of the vulnerability by attempting to read a known file (c:/windows/win.ini) via crafted URLs.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Pallets Werkzeug up to 0.15.4
No auth needed
Prerequisites: List of target URLs in a text file
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Nuclei Templates (1)

Pallets Werkzeug <0.15.5 - Local File Inclusion
HIGHby madrobot
Shodan: cpe:"cpe:2.3:o:microsoft:windows"

References (2)

Core 2
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://palletsprojects.com/blog/werkzeug-0-15-5-released/
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html

Scores

CVSS v3 7.5
EPSS 0.9006
EPSS Percentile 99.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-22
Status published
Products (2)
palletsprojects/werkzeug < 0.15.5
pypi/werkzeug 0 - 0.15.5PyPI
Published Jul 28, 2019
Tracked Since Feb 18, 2026