CVE-2026-21860: Werkzeug Vulnerability in safe_join Function Allows Exploitation of Windows Special Device Names
Summary
CVE-2026-21860: Werkzeug safe_join() allows Windows special device names with compound extensions. Affects werkzeug versions < 3.1.5. Fixed in 3.1.5. How to fix ↓
Also tracked for
- Werkzeug ·
The same CVE-2026-21860 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Werkzeug is a comprehensive WSGI utility library for Python that provides various tools for building web applications. It is widely used in the Flask framework and offers features such as request and response handling, routing, and debugging. However, it has a vulnerability in its safe_join function, which can be exploited on Windows systems due to the handling of special device names.
Vulnerability Detail
The vulnerability in Werkzeug's safe_join function arises from its failure to properly validate path segments that include Windows special device names, such as CON and AUX, when combined with file extensions or trailing spaces. This oversight allows attackers to craft file paths that can lead to indefinite hangs when attempting to read these files, as the system treats them as valid paths. The issue was previously reported but not fully resolved, allowing compound extensions like CON.txt.html to bypass security checks.
How To Fix
Latest published version: 3.1.9 as of 22 Oct 2026
pip install --upgrade "werkzeug==3.1.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.5
This is the first release that contains the fix.
pip install --upgrade "werkzeug==3.1.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using user-specified paths that may include Windows special device names or ensure that your application performs additional validation on file paths before processing them.
Conclusion
The vulnerability identified as CVE-2026-21860 in Werkzeug's safe_join function poses a risk to applications running on Windows by allowing the use of special device names in file paths. It is crucial to update to the patched version 3.1.5 or later to mitigate this risk. Additionally, implementing proper validation for file paths can serve as a temporary workaround.
See every vulnerability recorded for werkzeug →
FAQ
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Windows special device names are reserved names like CON, AUX, and NUL that refer to system devices and can cause issues if not handled properly in file paths.
If your application attempts to read a file with a special device name, the read operation may hang indefinitely, causing your application to become unresponsive.
While there is no direct risk of data loss, the vulnerability can lead to application hangs, which may disrupt service and affect user experience.
References
Related vulnerabilities
Recent vulnerabilities recorded for werkzeug.
