CVE-2026-21860: Werkzeug safe_join() allows Windows special device names with compound extensions
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21860?
CVE-2026-21860 has been classified as a high severity vulnerability due to the risk of directory traversal attacks.
How do I fix CVE-2026-21860?
To mitigate CVE-2026-21860, upgrade Werkzeug to version 3.1.5 or later.
What does CVE-2026-21860 affect?
CVE-2026-21860 affects versions of Werkzeug prior to 3.1.5.
What is the nature of the vulnerability in CVE-2026-21860?
CVE-2026-21860 allows unsafe path segment handling with Windows device names, which can lead to security vulnerabilities.
Is CVE-2026-21860 specific to any operating system?
Yes, CVE-2026-21860 is specifically a concern for applications running on Windows.