CVE-2026-21860

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21860", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-05T16:44:16.367Z", "datePublished": "2026-01-08T18:34:05.390Z", "dateUpdated": "2026-01-08T18:50:34.504Z"}, "containers": {"cna": {"title": "Werkzeug safe_join() allows Windows special device names with compound extensions", "problemTypes": [{"descriptions": [{"cweId": "CWE-67", "lang": "en", "description": "CWE-67: Improper Handling of Windows Device Names", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7"}, {"name": "https://github.com/pallets/werkzeug/commit/7ae1d254e04a0c33e241ac1cca4783ce6c875ca3", "tags": ["x_refsource_MISC"], "url": "https://github.com/pallets/werkzeug/commit/7ae1d254e04a0c33e241ac1cca4783ce6c875ca3"}], "affected": [{"vendor": "pallets", "product": "werkzeug", "versions": [{"version": "< 3.1.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T18:34:05.390Z"}, "descriptions": [{"lang": "en", "value": "Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5."}], "source": {"advisory": "GHSA-87hc-h4r5-73f7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T18:50:24.550661Z", "id": "CVE-2026-21860", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T18:50:34.504Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21860", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T18:50:24.550661Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T18:50:31.180Z"}}], "cna": {"title": "Werkzeug safe_join() allows Windows special device names with compound extensions", "source": {"advisory": "GHSA-87hc-h4r5-73f7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "pallets", "product": "werkzeug", "versions": [{"status": "affected", "version": "< 3.1.5"}]}], "references": [{"url": "https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7", "name": "https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pallets/werkzeug/commit/7ae1d254e04a0c33e241ac1cca4783ce6c875ca3", "name": "https://github.com/pallets/werkzeug/commit/7ae1d254e04a0c33e241ac1cca4783ce6c875ca3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-67", "description": "CWE-67: Improper Handling of Windows Device Names"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T18:34:05.390Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21860", "state": "PUBLISHED", "dateUpdated": "2026-01-08T18:50:34.504Z", "dateReserved": "2026-01-05T16:44:16.367Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-08T18:34:05.390Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "werkzeug", "vendor": "pallets", "versions": [{"status": "affected", "version": "< 3.1.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*", "matchCriteriaId": "B45012A0-44EF-4DE3-9D85-C02212BD7F27", "versionEndExcluding": "3.1.5", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5."}, {"lang": "es", "value": "Werkzeug es una completa biblioteca de aplicaciones web WSGI. Antes de la versi\u00f3n 3.1.5, la funci\u00f3n safe_join de Werkzeug permite segmentos de ruta con nombres de dispositivos de Windows que tienen extensiones de archivo o espacios finales. En Windows, existen nombres de dispositivos especiales como CON, AUX, etc. que est\u00e1n impl\u00edcitamente presentes y son legibles en cada directorio. Windows a\u00fan los acepta con cualquier extensi\u00f3n de archivo, como CON.txt, o espacios finales como CON. Este problema ha sido parcheado en la versi\u00f3n 3.1.5."}], "id": "CVE-2026-21860", "lastModified": "2026-06-17T10:19:02.740", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21860", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T18:50:24.550661Z", "version": "2.0.3"}}]}, "published": "2026-01-08T19:15:59.000", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/pallets/werkzeug/commit/7ae1d254e04a0c33e241ac1cca4783ce6c875ca3"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-67"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T07:32:46.207126+00:00", "value": {"mitigation_remediation": ["Upgrade Werkzeug to version 3.1.5 or later.", "If patch cannot be applied immediately, implement custom validation to reject filenames containing Windows device names such as CON, AUX, PRN, NUL, COM1\u2013COM9, and LPT1\u2013LPT9, including their variants with extensions or trailing spaces.", "Configure the application to run with minimal privileges and enforce directory restrictions to prevent unintended file system access."], "summary": {"action": "Upgrade to 3.1.5", "impact": "Read arbitrary Windows device files"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of Werkzeug prior to 3.1.5 that run on Windows operating systems. It is relevant to any Python web application that includes Werkzeug as a dependency, such as Flask or other frameworks that rely on Werkzeug\u2019s safe_join for file handling. The issue does not exist in non\u2011Windows environments, nor in Werkzeug versions 3.1.5 and newer, where the fix is already in place.", "description_and_impact": "Werkzeug is a Python WSGI library used to build web applications. A flaw was discovered in the safe_join helper function used to combine path components before version 3.1.5. The function fails to reject Windows\u2011specific device names such as CON, AUX, PRN, NUL, COM1\u2013COM9, and LPT1\u2013LPT9 when those names are combined with file extensions or trailing spaces. Because Windows treats these names as built\u2011in devices accessible from any directory, an attacker can construct a request that resolves to a device stream and read its contents or enumerate the devices, exposing data that the application should not normally access.", "risk_and_exploitability": "The CVSS score is 6.3, indicating a moderate severity. Ephemeral probability of exploitation is low (< 1\u202f%) and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The attack requires that the application uses safe_join to construct a file path on a Windows host; an attacker could supply a crafted path or file name, cause safe_join to resolve to a device name, and then read the resulting device stream. The low exploitation likelihood, coupled with the availability of a straightforward patch, means the risk to a well\u2011maintained systems portfolio is modest."}}}}, "created": "2026-01-09T13:24:11.039077+00:00", "updated": "2026-04-18T07:45:24.972692+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$windows", "palletsprojects", "palletsprojects$PRODUCT$werkzeug"]}