CVE-2024-49766CWE-22

Werkzeug safe_join not safe on Windows

Medium · published October 25, 2024

CVSS v4.0
6.3
EPSS
1%
Percentile
55.3
In the wild
Unconfirmed
What it is

Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00776 · 55.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-10-25T19:22Z
EPSS history
Timeline
  • 25 OCT 19:22Z
    Werkzeug safe_join not safe on Windows
    cvelistv5