Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-66221

Good to know:

icon
icon
icon

Date: November 28, 2025

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.

Severity Score

Related Resources (5)

https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2
https://github.com/pallets/werkzeug/commit/4b833376a45c323a189cd11d2362bcffdb1c0c13
https://github.com/pallets/werkzeug/releases/tag/3.1.4
https://nvd.nist.gov/vuln/detail/CVE-2025-66221
https://www.mend.io/vulnerability-database/CVE-2025-66221

Severity Score

Weakness Type (CWE)

Improper Handling of Windows Device Names

CWE-67

Top Fix

icon

Upgrade Version

Upgrade to version werkzeug - 3.1.4;https://github.com/pallets/werkzeug.git - 3.1.4

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): NONE
Availability (A): LOW

Do you need more information?

Contact Us