Snyk
security.snyk.io › snyk vulnerability database › pip
Directory Traversal in werkzeug | CVE-2019-14322 | Snyk
One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the ...
CTFtime.org
ctftime.org › writeup › 26943
CTFtime.org / b01lers CTF / lorem_ipsum / Writeup
1. Don’t use Werkzeug debugger lol 2. Give the `?animal=` GET parameter something unexpected (`?animal=blah`) and get yourself a traceback with a python console (Werkzeug lol) 3. Oh wait it’s PIN protected 4. Nevermind you can generate the pin yourself 5. Directory-traversal though `?animal=` ...
Veracode
sca.analysiscenter.veracode.com › vulnerability-database › security › 1 › 1 › sid-20917 › summary
Directory Traversal Vulnerability in the werkzeug library
We cannot provide a description for this page right now
Veracode
sourceclear.com › vulnerability-database › security › directory-traversal › python › sid-20917
Directory Traversal Vulnerability in the werkzeug library | Veracode
werkzeug (werkzeug). werkzeug is vulnerable to directory traversal. An attacker is able to access arbitrary files through the SharedDataMiddleware due to the way Python's `os.path.join()` function works on Windows.
Vulnlab
arz101.medium.com › hackthebox-bagel-53f733fc517c
HackTheBox — Bagel - ARZ101 - Medium
June 3, 2023 - | Socks5: | <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" | "http://www.w3.org/TR/html4/strict.dtd"> | <html> | <title>Error response</title> | </head> | <body> | <h1>Error response</h1> | <p>Error code: 400</p> | <p>Message: Bad request syntax (' | ').</p> | <p>Error code explanation: HTTPStatus.BAD_REQUEST - Bad request syntax or unsupported method.</p> | </body> |_ </html> |_http-title: Did not follow redirect to http://bagel.htb:8000/?page=index.html | http-methods: |_ Supported Methods: GET OPTIONS HEAD |_http-server-header: Werkzeug/2.2.2 Python/3.10.9 · The port redirects to bagel.htb, so adding that in hosts file ... Going back to home page, we can see it’s include an html page with page parameter, we can try testing for directory traversal/file Read
HackTricks
book.hacktricks.xyz › home › network services pentesting › pentesting web › werkzeug
Werkzeug / Flask Debug - HackTricks
3 days ago - The PIN generation mechanism can be studied from the Werkzeug source code repository, though it is advised to procure the actual server code via a file traversal vulnerability due to potential version discrepancies. To exploit the console PIN, two sets of variables, probably_public_bits and private_bits, are needed: username: Refers to the user who initiated the Flask session. ... getattr(mod, '__file__', None): Represents the full path to app.py within the Flask directory (e.g., /usr/local/lib/python3.5/dist-packages/flask/app.py).
GitLab
0xdf.gitlab.io › 2022 › 10 › 08 › htb-opensource.html
HTB: OpenSource | 0xdf hacks stuff - GitLab
October 8, 2022 - I’ll do a quick check to see if I can traverse up directories by sending the POST request to Burp Repeater and adding ../../../../../../../ to the start of the filename, but it seems to strip that and save it in the same place. I could spend time trying to bypass that filtering, but as I have the source, I’ll turn there. nmap identified that this was a Werkzeug Python server, so it’s likely running Flask. This is from the HTTP response headers: HTTP/1.1 200 OK Server: Werkzeug/2.1.2 Python/3.10.3 Date: Thu, 29 Sep 2022 19:21:59 GMT Content-Type: text/html; charset=utf-8 Content-Length: 5316 Connection: close
GitHub
github.com › RipudamanKaushikDal › projects › issues › 21
Security Vulnerability Found · Issue #21 · RipudamanKaushikDal/projects
This leads to a path traversal attack. The bug can be verified using a proof of concept similar to the one shown below. curl --path-as-is 'http://<domain>/photos//../../../../etc/passwd"' This can be fixed by preventing flow of untrusted data to the vulnerable send_file function. In case the application logic necessiates this behaviour, one can either use the werkzeug.utils.safe_join to join untrusted paths or replace flask.send_file calls with flask.send_from_directory calls.
Author RipudamanKaushikDal
Snyk
security.snyk.io › snyk vulnerability database › pip
Directory Traversal in werkzeug | CVE-2024-49766 | Snyk
Werkzeug is a WSGI web application library. Affected versions of this package are vulnerable to Directory Traversal due to a bypass for os.path.isabs(), which allows the improper handling of UNC paths beginning with /, in the safe_join() function.
Exploit-DB
exploit-db.com › exploits › 50101
Pallets Werkzeug 0.15.4 - Path Traversal - Python webapps Exploit
July 6, 2021 - Pallets Werkzeug 0.15.4 - Path Traversal. CVE-2019-14322 . webapps exploit for Python platform
Global Security Mag
globalsecuritymag.com › vigilance-fr-werkzeug-directory-traversal-via-safe_join-analyzed-on-02-04-2025.html
Vigilance.fr - Werkzeug: directory traversal via safe_join(), analyzed on 02/04/2025 – Global Security Mag Online
June 2, 2025 - An attacker can traverse directories of Werkzeug, via safe_join(), in order to read a file outside the service root path.
SentinelOne
sentinelone.com › home › vulnerability database › cve-2026-21860
CVE-2026-21860: Werkzeug Path Traversal Vulnerability
January 22, 2026 - This vulnerability stems from improper ... of Windows Device Names). The function is designed to safely join untrusted path components to a base directory, preventing path traversal attacks....
Vulert
vulert.com › vuln-db › CVE-2024-49766
CVE-2024-49766: Werkzeug Path Traversal Vulnerability on Windows
The vulnerability identified as CVE-2026-21860 in Werkzeug's safe_join function poses a risk to applications running on Windows by allowing the use of special device names in file paths. It is crucial to update to the patched version 3.1.5 or later t ...
Versioneye
versioneye.com › Python › werkzeug › 0.11
Python/werkzeug/0.11
Recommendation: Update to version 3.1.8. Werkzeug safe_join() allows Windows special device names ... Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory...
Snyk
security.snyk.io › snyk vulnerability database › pip
werkzeug | Snyk
Published: 18 years ago Last updated: 3 months ago Latest version: 3.1.8 Latest non-vulnerable version: 3.1.8 ... Loading chart... ... Further analysis of the maintenance status of Werkzeug based on released PyPI versions cadence, the repository activity, and other data points determined that its maintenance is Healthy.
GitHub
github.com › pallets › werkzeug › issues › 1589
Absolute path traversal in SharedDataMiddleware on Windows · Issue #1589 · pallets/werkzeug
July 20, 2019 - import os from werkzeug.middleware.shared_data import SharedDataMiddleware from werkzeug.serving import run_simple def null(environ, start_response): start_response('404 NOT FOUND', [('Content-Type', 'text/plain')]) yield b'not found' app = SharedDataMiddleware(null, { '/static': os.path.join(os.path.dirname(__file__), 'static'), }) if __name__ == '__main__': run_simple('localhost', 5000, app)
Author pallets
Medium
infosecwriteups.com › angstromctf-2018-web-writeups-part-2-6c1ee586aa64
AngstromCTF 2018 WEB Writeups — Part 2 | by Abdelkader Belcaid | InfoSec Write-ups
August 26, 2018 - A Path Traversal Attack is when an attacker supplies input that gets used with our path to access a file on the file system that we did not intend. The input usually attempts to break out the application’s working directory and access a file elsewhere on the file system.
Acunetix
acunetix.com › vulnerabilities › web › werkzeug-wsgi-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-vulnerability-cve-2019-14322
Werkzeug WSGI Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2019-14322) - Vulnerabilities - Acunetix
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.... Werkzeug WSGI Improper
NIST
nvd.nist.gov › vuln › detail › CVE-2024-49766
CVE-2024-49766 Detail - NVD
October 25, 2024 - This is a potential security issue, you are being redirected to https://nvd.nist.gov · Official websites use .gov A .gov website belongs to an official government organization in the United States
GitHub
github.com › rapid7 › metasploit-framework › blob › master › documentation › modules › exploit › multi › http › werkzeug_debug_rce.md
metasploit-framework/documentation/modules/exploit/multi/http/werkzeug_debug_rce.md at master · rapid7/metasploit-framework
MODULENAME: Name of the application module. Often flask.app or werkzeug.debug · SERVICEUSER: User account name that the service is running under. This may be an empty string ('') in some cases . If you have path traversal on Linux, you may be able to read this from /proc/self/environ
Author rapid7