CVE-2024-49766mediumobserved exploitationCWE-22

CVE-2024-49766: medium-severity vulnerability in pallets werkzeug

Werkzeug safe_join not safe on Windows

Published · Updated

Follow this CVE+ Monitor werkzeug+ Monitor werkzeug

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

35Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Attendcvss 6.3epss 0.8%
from disclosure to weapon
Published on NVDOct 25
VulnCheck+705d
Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
pallets · werkzeug
Related CVEs — pallets werkzeug

In the same product, most dangerous first.

CVE-2024-34069HIGHWerkzeug's improper usage of a pathname and improper CSRF protection results in the remote command executionEPSS 3.4%CVE-2023-25577HIGHWerkzeug may allow high resource usage when parsing multipart form data with many fieldsEPSS 1.4%CVE-2023-46136HIGHWerkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginningEPSS 1.3%CVE-2024-49767MEDIUMWerkzeug possible resource exhaustion when parsing file data in formsEPSS 1.1%CVE-2026-27199MEDIUMWerkzeug safe_join() allows Windows special device namesEPSS 0.6%CVE-2025-66221MEDIUMWerkzeug safe_join() allows Windows special device namesEPSS 0.5%