#VU123583 Improper Handling of Windows Device Names in Werkzeug - CVE-2026-21860
Published: March 5, 2026
Vulnerability identifier: #VU123583
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-21860
CWE-ID: CWE-67
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Werkzeug
Werkzeug
Software vendor:
The Pallets Projects
The Pallets Projects
Description
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Remediation
Install updates from vendor's website.