Executive brief
Werkzeug safe_join() allows Windows special device names with compound extensions
Affected products
- PyPI werkzeug
Junglewise Threat Intelligence
CVE-2026-21860: PYSEC-2026-2044 - Werkzeug safe_join() allows Windows special device names with compound extensions
CVE-2026-21860 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: werkzeug (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2046 - Werkzeug safe_join() allows Windows special device names
- PYSEC-2026-2045 - Werkzeug safe_join not safe on Windows
- PYSEC-2026-2043 - Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
- PYSEC-2026-1065 - Pallets Werkzeug vulnerable to Path Traversal
- PYSEC-2026-2320 - Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as fi