Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join
    function allows path segments with Windows device names. On Windows, there are special device names such
    as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses
    safe_join to safely serve files at user-specified paths under a directory. If the application is running
    on Windows, and the requested path ends with a special device name, the file will be opened successfully,
    but reading will hang indefinitely. This issue has been patched in version 3.1.4. (CVE-2025-66221)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join     function allows path segments with Windows device names. On Windows, there are special device names such     as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses     safe_join to safely serve files at user-specified paths under a directory. If the application is running     on Windows, and the requested path ends with a special device name, the file will be opened successfully,     but reading will hang indefinitely. This issue has been patched in version 3.1.4. (CVE-2025-66221)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
437060	SCA: security update for werkzeug (GHSA-hgf8-39gv-g3f2)	Tenable Cloud Security	SCA Checks	medium
437060	SCA: security update for werkzeug (GHSA-hgf8-39gv-g3f2)	Tenable Self-Hosted Container Security	SCA Checks	medium
277057	Linux Distros Unpatched Vulnerability : CVE-2025-66221	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-66221

medium

Tenable Plugins

medium

medium

medium