Description
Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.
References (4)
Core 4
Core References
Third Party Advisory
https://security.netapp.com/advisory/ntap-20250131-0005/
Vendor Advisory x_refsource_confirm
https://github.com/pallets/werkzeug/security/advisories/GHSA-f9vj-2wh5-fj8j
Patch x_refsource_misc
https://github.com/pallets/werkzeug/commit/2767bcb10a7dd1c297d812cc5e6d11a474c1f092
Release Notes x_refsource_misc
https://github.com/pallets/werkzeug/releases/tag/3.0.6
Scores
CVSS v3
5.3
EPSS
0.0139
EPSS Percentile
80.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Products (2)
palletsprojects/werkzeug
< 3.0.6
pypi/Werkzeug
0 - 3.0.6PyPI
Published
Oct 25, 2024
Tracked Since
Feb 18, 2026