CVE-2025-66221

MEDIUM EPSS 37.5%
Published Nov 29, 20257mo ago · Modified Jun 17, 20261w ago
6.3 CVSS 4.0
Medium
Find Similar
Published Nov 29, 2025 7mo ago
Last Modified Jun 17, 2026 1w ago

Description

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.

CVSS Details

Base Score
6.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
37.5% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-67

Affected Products 2

VendorProductVersionRange
palletsprojectswerkzeug* <3.1.4
microsoftwindows*any

References 3

  • github.com https://github.com/pallets/werkzeug/commit/4b833376a45c323a189cd11d2362bcffdb1c0c13
    Patch
  • github.com https://github.com/pallets/werkzeug/releases/tag/3.1.4
    Release Notes
  • github.com https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2
    Vendor Advisory

Remediation

  • github.com https://github.com/pallets/werkzeug/commit/4b833376a45c323a189cd11d2362bcffdb1c0c13
    Patch