CVE-2024-49766 Werkzeug safe_join not safe on Windows

What is CVE-2024-49766?

CVE-2024-49766 is a medium-severity vulnerability in pallets werkzeug, published on 25 Oct 2024.

Official description

Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.

Weakness: CWE-22

Which versions are affected by CVE-2024-49766?

3 open source packages ship an affected version, including werkzeug and Werkzeug. It affects 1 product.

Products include Palletsprojects Werkzeug.

How do I fix CVE-2024-49766?

Upgrade werkzeug to 3.0.6 or later.

Is CVE-2024-49766 being exploited?

There is no known exploitation of CVE-2024-49766 in the wild and no public exploit code.

Other vulnerabilities in pallets werkzeug

• CVE-2022-29361 Other in n/a Critical 9.8
• CVE-2023-46136 Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning High 8.0
• CVE-2023-25577 Werkzeug may allow high resource usage when parsing multipart form data with many fields High 7.5
• CVE-2019-14322 Pallets Werkzeug vulnerable to Path Traversal High 7.5
• CVE-2026-27199 Werkzeug safe_join() allows Windows special device names Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-KC63022, CLEANSTART-2026-LS94875, ECHO-9c5b-9fe7-f077, GHSA-f9vj-2wh5-fj8j, MINI-c474-jj9x-pjjm, MINI-h843-xcjh-979v and 2 more.