Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function
    allows Windows device names as filenames if preceded by other path segments. This was previously reported
    as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts
    paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to
    safely serve files at user-specified paths under a directory. If the application is running on Windows,
    and the requested path ends with a special device name, the file will be opened successfully, but reading
    will hang indefinitely. This issue has been fixed in version 3.1.6. (CVE-2026-27199)

ID	Name	Product	Family	Type	Severity
458341	Echo: werkzeug: security update to 2.2.3+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
458341	Echo: werkzeug: security update to 2.2.3+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
437878	SCA: security update for werkzeug (GHSA-29vq-49wr-vm6x)	Tenable Cloud Security	SCA Checks	Local	medium
437878	SCA: security update for werkzeug (GHSA-29vq-49wr-vm6x)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-27199

medium

Tenable Plugins

medium

medium

medium

medium