Snyk
security.snyk.io › snyk vulnerability database › pip
Directory Traversal in werkzeug | CVE-2019-14322 | Snyk
One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the ...
Veracode
sca.analysiscenter.veracode.com › vulnerability-database › security › 1 › 1 › sid-20917 › summary
Directory Traversal Vulnerability in the werkzeug library
We cannot provide a description for this page right now
Vulnlab
arz101.medium.com › hackthebox-bagel-53f733fc517c
HackTheBox — Bagel - ARZ101 - Medium
June 3, 2023 - | Socks5: | <!DOCTYPE HTML PUBLIC ... Werkzeug/2.2.2 Python/3.10.9 · The port redirects to bagel.htb, so adding that in hosts file ... Going back to home page, we can see it’s include an html page with page parameter, we can try testing for directory traversal/file ...
CTFtime.org
ctftime.org › writeup › 26943
CTFtime.org / b01lers CTF / lorem_ipsum / Writeup
1. Don’t use Werkzeug debugger lol 2. Give the `?animal=` GET parameter something unexpected (`?animal=blah`) and get yourself a traceback with a python console (Werkzeug lol) 3. Oh wait it’s PIN protected 4. Nevermind you can generate the pin yourself 5. Directory-traversal though `?animal=` ...
HackTricks
book.hacktricks.xyz › home › network services pentesting › pentesting web › werkzeug
Werkzeug / Flask Debug - HackTricks
2 days ago - The PIN generation mechanism can be studied from the Werkzeug source code repository, though it is advised to procure the actual server code via a file traversal vulnerability due to potential version discrepancies. To exploit the console PIN, two sets of variables, probably_public_bits and private_bits, are needed: username: Refers to the user who initiated the Flask session. ... getattr(mod, '__file__', None): Represents the full path to app.py within the Flask directory (e.g., /usr/local/lib/python3.5/dist-packages/flask/app.py).
Veracode
sourceclear.com › vulnerability-database › security › directory-traversal › python › sid-20917
Directory Traversal Vulnerability in the werkzeug library | Veracode
werkzeug (werkzeug). werkzeug is vulnerable to directory traversal. An attacker is able to access arbitrary files through the SharedDataMiddleware due to the way Python's `os.path.join()` function works on Windows.
Snyk
security.snyk.io › snyk vulnerability database › pip › werkzeug
werkzeug 2.2.2 | Snyk
Security vulnerabilities and package health score for pip package werkzeug 2.2.2
Versioneye
versioneye.com › Python › werkzeug › 0.11
Python/werkzeug/0.11
Affected versions: ["0.15.2", "0.15.1", ... "0.2", "0.1"] ... Recommendation: Update to version 3.1.8. Werkzeug safe_join() allows Windows special device names ... Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory...
GitHub
github.com › RipudamanKaushikDal › projects › issues › 21
Security Vulnerability Found · Issue #21 · RipudamanKaushikDal/projects
This leads to a path traversal attack. The bug can be verified using a proof of concept similar to the one shown below. curl --path-as-is 'http://<domain>/photos//../../../../etc/passwd"' This can be fixed by preventing flow of untrusted data to the vulnerable send_file function. In case the application logic necessiates this behaviour, one can either use the werkzeug.utils.safe_join to join untrusted paths or replace flask.send_file calls with flask.send_from_directory calls.
Author RipudamanKaushikDal
Snyk
security.snyk.io › snyk vulnerability database › pip
Directory Traversal in werkzeug | CVE-2024-49766 | Snyk
Werkzeug is a WSGI web application library. Affected versions of this package are vulnerable to Directory Traversal due to a bypass for os.path.isabs(), which allows the improper handling of UNC paths beginning with /, in the safe_join() function.
Global Security Mag
globalsecuritymag.com › vigilance-fr-werkzeug-directory-traversal-via-safe_join-analyzed-on-02-04-2025.html
Vigilance.fr - Werkzeug: directory traversal via safe_join(), analyzed on 02/04/2025 – Global Security Mag Online
June 2, 2025 - An attacker can traverse directories of Werkzeug, via safe_join(), in order to read a file outside the service root path.
SentinelOne
sentinelone.com › home › vulnerability database › cve-2026-21860
CVE-2026-21860: Werkzeug Path Traversal Vulnerability
January 22, 2026 - An attacker would craft HTTP requests containing malicious path segments targeting the safe_join function. The exploitation requires the target application to be running on a Windows system and to process user-supplied path components through ...
Acunetix
acunetix.com › vulnerabilities › web › werkzeug-wsgi-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-vulnerability-cve-2019-14322
Werkzeug WSGI Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2019-14322) - Vulnerabilities - Acunetix
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.... Werkzeug WSGI Improper
Cybersecurity Help
cybersecurity-help.cz › vdb › palletsprojects › werkzeug › 2.2.2
Known Vulnerabilities in Werkzeug 2.2.2
List of known vulnerabilities in Werkzeug in version 2.2.2
Exploit-DB
exploit-db.com › exploits › 50101
Pallets Werkzeug 0.15.4 - Path Traversal - Python webapps Exploit
July 6, 2021 - Due to the way Python's os.path.join() function works on Windows, a path segment with a drive name will change the drive of the final path. TLDR; In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames lead to arbitrary file download.
GitLab
0xdf.gitlab.io › 2022 › 10 › 08 › htb-opensource.html
HTB: OpenSource | 0xdf hacks stuff - GitLab
October 8, 2022 - I’ll do a quick check to see if I can traverse up directories by sending the POST request to Burp Repeater and adding ../../../../../../../ to the start of the filename, but it seems to strip that and save it in the same place. I could spend time trying to bypass that filtering, but as I have the source, I’ll turn there. nmap identified that this was a Werkzeug Python server, so it’s likely running Flask. This is from the HTTP response headers: HTTP/1.1 200 OK Server: Werkzeug/2...
IBM
ibm.com › support › pages › security-bulletin-vulnerabilities-mongodb-python-nodejs-golang-go-linux-kernel-affect-ibm-spectrum-protect-plus-0
Security Bulletin: Vulnerabilities in MongoDB, Python, Node.js, Golang Go, Linux kernel affect IBM Spectrum Protect Plus
March 10, 2026 - Werkzeug version 3.0.6 contains a patch. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVSS Source: NVD CVSS Base score: 5.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2024-49767 DESCRIPTION: Werkzeug is a Web Server Gateway Interface web application library.
Vulert
vulert.com › vuln-db › CVE-2024-49766
CVE-2024-49766: Werkzeug Path Traversal Vulnerability on Windows
The vulnerability arises from Werkzeug's reliance on the os.path.isabs() function to validate paths. On Windows systems with Python versions earlier than 3.11, this function fails to correctly identify UNC paths (e.g., //server/share) as absolute paths. Consequently, the safe_join function can generate unsafe paths, potentially allowing attackers to access files outside the intended directory.
Snyk
security.snyk.io › snyk vulnerability database › pip
werkzeug | Snyk
Security vulnerabilities and package health score for pip package werkzeug
NIST
nvd.nist.gov › vuln › detail › CVE-2024-49766
CVE-2024-49766 Detail - NVD
October 25, 2024 - This is a potential security issue, you are being redirected to https://nvd.nist.gov · Official websites use .gov A .gov website belongs to an official government organization in the United States