-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the safe_join function in werkzeug.security. The provided patch 7ae1d254e04a0c33e241ac1cca4783ce6c875ca3 clearly shows the fix. The original code used os.path.splitext(filename)[0] to extract the base name of the file before checking it against a list of Windows special device names. This was flawed because splitext only removes the final extension. A filename like CON.txt.html would be processed as CON.txt, which was not in the list of special names, thus bypassing the check. The patch corrects this by using filename.partition('.')[0].strip(), which correctly isolates the base name (CON) before the first dot and removes any trailing spaces, effectively closing the loophole. The vulnerability could be triggered by any function that uses safe_join to construct a file path from user input, such as send_from_directory, leading to a denial-of-service attack on Windows-based systems.
safe_joinsrc/werkzeug/security.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Werkzeug | pip | < 3.1.5 | 3.1.5 |