N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27199

CVE-2026-27199: Werkzeug safe_join() allows Windows special device names

Werkzeug's safe_join function allows Windows device names as filenames if when preceded by other path segments.

This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL.

send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27199

CVE-2026-27199:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
werkzeug	pip	< 3.1.6	3.1.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch commit f407712fdc60a09c2b3f4fe7db557703e5d9338d clearly indicates that the safe_join function in src/werkzeug/security.py is the source of the vulnerability. The diff shows a change in how Windows special device names are checked. The original implementation was flawed as it only checked the beginning of a given path, failing to account for paths with multiple segments like some_dir/NUL. The fix involves splitting the path by / and checking each component individually against a blocklist of device names. The vulnerability description explicitly states that send_from_directory uses safe_join, and an exploit would involve passing a crafted path to an endpoint that uses this function. Therefore, safe_join is the root vulnerable function that would appear in a runtime profile during exploitation.

Vulnerable functions

safe_join

src/werkzeug/security.py

The vulnerability lies in the `safe_join` function, which is responsible for safely combining a trusted directory path with untrusted path components. In the vulnerable version, the check for Windows special device names (e.g., 'NUL', 'CON', 'PRN') was insufficient for multi-segment paths. The original code only checked the beginning of the path string, allowing a malicious user to provide a path like 'example/NUL'. When the application, running on Windows, attempts to access this path via a function like `send_from_directory` (which uses `safe_join`), it tries to open the special device, causing the process to hang indefinitely and resulting in a denial of service. The patch addresses this by splitting the path into individual segments and checking each segment for a device name.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.