Werkzeug 2.3.8 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the Werkzeug package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Improper Handling of Windows Device Names Affected versions of this package are vulnerable to Improper Handling of Windows Device Names via the `safe_join()` function, which permits path segments containing Windows special device names with file extensions or trailing spaces. An attacker can access unintended files or devices by crafting malicious path inputs. Note: This issues exists due to the incomplete fix for CVE-2025-66221 that failed to account for compound extensions such as `CON.txt.html` or trailing spaces. How to fix Improper Handling of Windows Device Names? Upgrade `werkzeug` to version 3.1.5 or higher.	[,3.1.5)
M Improper Handling of Windows Device Names Affected versions of this package are vulnerable to Improper Handling of Windows Device Names via the `safe_join` function. An attacker can cause the application to hang indefinitely by requesting a path ending with a Windows special device name, e.g. `CON` or `NUL`. Note: This is only vulnerable on Windows, where special device names are implicitly present in every directory. How to fix Improper Handling of Windows Device Names? Upgrade `werkzeug` to version 3.1.4 or higher.	[,3.1.4)
M Allocation of Resources Without Limits or Throttling Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in `formparser.MultiPartParser()`. An attacker can cause the parser to consume more memory than the upload size, in excess of `max_form_memory_size`, by sending malicious data in a non-file field of a `multipart/form-data` request. How to fix Allocation of Resources Without Limits or Throttling? Upgrade `werkzeug` to version 3.0.6 or higher.	[,3.0.6)
M Directory Traversal Werkzeug is a WSGI web application library. Affected versions of this package are vulnerable to Directory Traversal due to a bypass for `os.path.isabs()`, which allows the improper handling of UNC paths beginning with `/`, in the `safe_join()` function. This allows an attacker to read some files on the affected server, if they are stored in an affected path. Note: This is only exploitable on Windows systems using Python versions prior to 3.11. How to fix Directory Traversal? Upgrade `Werkzeug` to version 3.0.6 or higher.	[,3.0.6)
H Remote Code Execution (RCE) Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient hostname checks and the use of relative paths to resolve requests. When the debugger is enabled, an attacker can convince a user to enter their own PIN to interact with a domain and subdomain they control, and thereby cause malicious code to be executed. The demonstrated attack vector requires a number of conditions that render this attack very difficult to achieve, especially if the victim application is running in the recommended configuration of not having the debugger enabled in production. How to fix Remote Code Execution (RCE)? Upgrade `werkzeug` to version 3.0.3 or higher.	[,3.0.3)

Vulnerability

Vulnerable Version

Improper Handling of Windows Device Names

Affected versions of this package are vulnerable to Improper Handling of Windows Device Names via the safe_join() function, which permits path segments containing Windows special device names with file extensions or trailing spaces. An attacker can access unintended files or devices by crafting malicious path inputs.

Note:

This issues exists due to the incomplete fix for CVE-2025-66221 that failed to account for compound extensions such as CON.txt.html or trailing spaces.

How to fix Improper Handling of Windows Device Names?

Upgrade werkzeug to version 3.1.5 or higher.

[,3.1.5)

Improper Handling of Windows Device Names

Affected versions of this package are vulnerable to Improper Handling of Windows Device Names via the safe_join function. An attacker can cause the application to hang indefinitely by requesting a path ending with a Windows special device name, e.g. CON or NUL.

Note: This is only vulnerable on Windows, where special device names are implicitly present in every directory.

How to fix Improper Handling of Windows Device Names?

Upgrade werkzeug to version 3.1.4 or higher.

[,3.1.4)

Allocation of Resources Without Limits or Throttling

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in formparser.MultiPartParser(). An attacker can cause the parser to consume more memory than the upload size, in excess of max_form_memory_size, by sending malicious data in a non-file field of a multipart/form-data request.

How to fix Allocation of Resources Without Limits or Throttling?

Upgrade werkzeug to version 3.0.6 or higher.

[,3.0.6)

Directory Traversal

Werkzeug is a WSGI web application library.

Affected versions of this package are vulnerable to Directory Traversal due to a bypass for os.path.isabs(), which allows the improper handling of UNC paths beginning with /, in the safe_join() function. This allows an attacker to read some files on the affected server, if they are stored in an affected path.

Note: This is only exploitable on Windows systems using Python versions prior to 3.11.

How to fix Directory Traversal?

Upgrade Werkzeug to version 3.0.6 or higher.

[,3.0.6)

Remote Code Execution (RCE)

Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to insufficient hostname checks and the use of relative paths to resolve requests. When the debugger is enabled, an attacker can convince a user to enter their own PIN to interact with a domain and subdomain they control, and thereby cause malicious code to be executed.

The demonstrated attack vector requires a number of conditions that render this attack very difficult to achieve, especially if the victim application is running in the recommended configuration of not having the debugger enabled in production.

How to fix Remote Code Execution (RCE)?

Upgrade werkzeug to version 3.0.3 or higher.

[,3.0.3)

Werkzeug@2.3.8 vulnerabilities

The comprehensive WSGI web application library.

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

Fix vulnerabilities automatically