Werkzeug safe_join not safe on Windows

MEDIUM 5.3CVE-2024-49766 · GHSA-f9vj-2wh5-fj8j · PYSEC-2026-2045 · Published 25/10/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
werkzeug PyPI	`< 3.0.6`	`3.0.6`
werkzeug palletsprojects	`< 3.0.6`	`3.0.6`

Description

On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable.

NVD description

Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.

References

pallets/werkzeug security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-49766 · ADVISORY
pallets/werkzeug commit 2767bcb · WEB
pallets/werkzeug · PACKAGE
pallets/werkzeug release 3.0.6 · WEB
security.netapp.com/advisory/ntap-20250131-0005 · WEB
security.netapp.com/advisory/ntap-20250131-0005 · Third Party Advisory
pypi.org/project/werkzeug · PACKAGE
GitHub Advisory GHSA-f9vj-2wh5-fj8j · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free