CVE-2019-14322 Pallets Werkzeug vulnerable to Path Traversal
Attackers can bypass path restrictions in SharedDataMiddleware on Windows to read arbitrary files via crafted drive names.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14322?
CVE-2019-14322 is a high-severity path traversal vulnerability in n/a, published on 28 Jul 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
Weakness: CWE-22
Which versions are affected by CVE-2019-14322?
3 open source packages ship an affected version, including werkzeug. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
werkzeug PyPI | All versions | 0.15.5 |
werkzeug PyPI | All versions | 0.15.5 |
werkzeug PyPI | All versions | 0.15.5 |
Products include Palletsprojects Werkzeug.
How do I fix CVE-2019-14322?
Upgrade werkzeug to 0.15.5 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-14322 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-14322 exists.
Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2022-29361 Other in n/a
- CVE-2023-46136 Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
- CVE-2023-25577 Werkzeug may allow high resource usage when parsing multipart form data with many fields
- CVE-2026-27199 Werkzeug safe_join() allows Windows special device names
- CVE-2026-21860 Werkzeug safe_join() allows Windows special device names with compound extensions
Sources
Also known as GHSA-j544-7q9p-6xp8, PYSEC-2026-1065.