CVE-2026-102598
Published:September 29, 2026
Updated:October 09, 2026
Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs on Windows with NTFS and serves a user-specified path ending in a special device name such as NUL:. The attack mechanism is that a requested path ends in a Windows special device name with an empty ADS marker. The impact is that the special device opens successfully and the file read hangs indefinitely. This issue is fixed in version 3.1.9.
Affected Packages
werkzeug (CONDA):
Affected version(s) >=0.8.3 <3.1.9Fix Suggestion:
Update to version 3.1.9werkzeug (CONDA):
Affected version(s) >=0.8.3 <3.1.9Fix Suggestion:
Update to version 3.1.9https://github.com/pallets/werkzeug.git (GITHUB):
Affected version(s) >=0.7 <3.1.9Fix Suggestion:
Update to version 3.1.9werkzeug (PYTHON):
Affected version(s) >=0.7 <3.1.9Fix Suggestion:
Update to version 3.1.9werkzeug (PYTHON):
Affected version(s) >=0.1 <3.1.9Fix Suggestion:
Update to version 3.1.9Related Resources (7)
Do you need more information?
Contact UsCVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
NONE
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
LOW
Weakness Type (CWE)
Improper Handling of Windows Device Names
EPSS
Base Score:
0.37