CVE-2026-102598: Werkzeug Vulnerability Allows Access to Windows Special Device Names
Summary
CVE-2026-102598: Werkzeug safe_join() allows Windows special device names. Affects werkzeug versions < 3.1.9. Fixed in 3.1.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Werkzeug is a comprehensive WSGI web application library for Python, providing utilities for building web applications. It includes features such as routing, request and response handling, and debugging tools. However, it has a vulnerability in its safe_join function that allows Windows special device names to be used as filenames, posing a risk for applications running on Windows NTFS file systems.
Vulnerability Detail
The vulnerability in Werkzeug's safe_join function arises from its failure to adequately filter Windows special device names when they have an empty Alternate Data Stream (ADS) marker. This oversight allows device names like 'NUL:' to be treated as valid file paths. When an application uses send_from_directory, which relies on safe_join, it can inadvertently open these special device files. This results in a situation where reading from such files hangs indefinitely, potentially leading to denial of service or other unintended behaviors.
How To Fix
Latest published version: 3.1.9 as of 22 Oct 2026
pip install --upgrade "werkzeug==3.1.9"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using user-specified paths that may include Windows special device names. Implement additional validation on file paths to ensure they do not contain any special device names before passing them to send_from_directory.
Conclusion
The vulnerability in Werkzeug's safe_join function allows for the use of Windows special device names, which can lead to application hangs and potential denial of service. It is crucial to update to version 3.1.9 or later to mitigate this risk. Additionally, implementing strict validation on file paths can further enhance security.
See every vulnerability recorded for werkzeug →
FAQ
The CVSS score of this vulnerability is 6.3, indicating a medium severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Windows special device names are reserved names in the Windows operating system that refer to system devices, such as 'NUL:', 'CON:', and 'PRN:'.
If exploited, the application may hang indefinitely when attempting to read from a special device file, leading to potential denial of service.
Yes, implementing strict validation on file paths and avoiding the use of user-specified paths that may include special device names can help prevent exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for werkzeug.
