GHSA-f9vj-2wh5-fj8jMedium

Werkzeug safe_join not safe on Windows

Published
October 25, 2024
Last Modified
January 31, 2025

🔗 CVE IDs covered (1)

CVE-2024-49766 →

📋 Description

On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable.

🎯 Affected products1

  • pip/Werkzeug:<= 3.0.5

🔗 References (6)