Pallets Werkzeug vulnerable to Path Traversal

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-14322 · ADVISORY
• pallets/werkzeug · WEB
• palletsprojects.com/blog/werkzeug-0-15-5-released · WEB
• packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html · WEB
• palletsprojects.com/blog/werkzeug-0-15-5-released · Release Notes
• pypi.org/project/werkzeug · PACKAGE
• GitHub Advisory GHSA-j544-7q9p-6xp8 · ADVISORY

werkzeug のその他の脆弱性

• CVE-2026-102598中 6.3Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL…
• CVE-2026-27199中 5.3Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as fi…
• CVE-2026-21860中 5.3Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Wi…
• CVE-2025-66221中 5.3Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Wi…
• CVE-2024-49767高 7.5Werkzeug is a Web Server Gateway Interface web application library. Applications using `werkzeug.formparser.MultiPartParser` corresponding t…