CVE-2026-21860 json
Werkzeug safe_join() allows Windows special device names with compound extensions
published 10mo ago modified last mo. also EUVD-2026-1425 , GHSA-87hc-h4r5-73f7 , PYSEC-2026-2044
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.
Patch / fix
- pypi werkzeug 3.1.5
- palletsprojects werkzeug 3.1.5
- py3-werkzeug Alpine 3.24 3.1.5-r0
alpine advisories ALPINE-CVE-2026-21860
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
Is CVE-2026-21860 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10mo ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CNA | 4.0 | 6.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | werkzeug | <3.1.5 |
3.1.5 |
Affected products
- pallets werkzeug
Classification
- Weakness
-
- CWE-67 Improper Handling of Windows Device Names
References
-
github.com
/pallets/werkzeug/commit/7ae1d254e04a0c33e241ac1cca4783ce6c875ca3
web, patch
-
github.com
/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-21860
advisory
-
github.com
/pallets/werkzeug
package
-
pypi.org
/project/werkzeug
package
-
github.com
/advisories/GHSA-87hc-h4r5-73f7
advisory
Sources
- CVE List CVE-2026-21860
- GitHub Advisory GHSA-87hc-h4r5-73f7
- NVD CVE-2026-21860
- OSV PYSEC-2026-2044
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.