CVE-2026-21860: Werkzeug safe_join() allows Windows special device names with compound extensions
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safejoin function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.
Other sources
Werkzeug's safejoin function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON .
This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the fix failed to account for compound extensions such as CON.txt.html or trailing spaces. It also missed some additional special names.
sendfromdirectory uses safejoin to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21860?
CVE-2026-21860 has been classified as a high severity vulnerability due to the risk of directory traversal attacks.
How do I fix CVE-2026-21860?
To mitigate CVE-2026-21860, upgrade Werkzeug to version 3.1.5 or later.
What does CVE-2026-21860 affect?
CVE-2026-21860 affects versions of Werkzeug prior to 3.1.5.
What is the nature of the vulnerability in CVE-2026-21860?
CVE-2026-21860 allows unsafe path segment handling with Windows device names, which can lead to security vulnerabilities.
Is CVE-2026-21860 specific to any operating system?
Yes, CVE-2026-21860 is specifically a concern for applications running on Windows.