Snyk
security.snyk.io › snyk vulnerability database › pip
Directory Traversal in werkzeug | CVE-2019-14322 | Snyk
One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the ...
Veracode
sca.analysiscenter.veracode.com › vulnerability-database › security › 1 › 1 › sid-20917 › summary
Directory Traversal Vulnerability in the werkzeug library
We cannot provide a description for this page right now
Vulnlab
arz101.medium.com › hackthebox-bagel-53f733fc517c
HackTheBox — Bagel - ARZ101 - Medium
June 3, 2023 - | Socks5: | <!DOCTYPE HTML PUBLIC ... Werkzeug/2.2.2 Python/3.10.9 · The port redirects to bagel.htb, so adding that in hosts file ... Going back to home page, we can see it’s include an html page with page parameter, we can try testing for directory traversal/file ...
CTFtime.org
ctftime.org › writeup › 26943
CTFtime.org / b01lers CTF / lorem_ipsum / Writeup
1. Don’t use Werkzeug debugger lol 2. Give the `?animal=` GET parameter something unexpected (`?animal=blah`) and get yourself a traceback with a python console (Werkzeug lol) 3. Oh wait it’s PIN protected 4. Nevermind you can generate the pin yourself 5. Directory-traversal though `?animal=` parameter for linux files (like `?animal=/../../sys/class/net/eth0/address`) 6.
HackTricks
book.hacktricks.xyz › home › network services pentesting › pentesting web › werkzeug
Werkzeug / Flask Debug - HackTricks
3 days ago - The PIN generation mechanism can be studied from the Werkzeug source code repository, though it is advised to procure the actual server code via a file traversal vulnerability due to potential version discrepancies. To exploit the console PIN, two sets of variables, probably_public_bits and private_bits, are needed: username: Refers to the user who initiated the Flask session. ... getattr(mod, '__file__', None): Represents the full path to app.py within the Flask directory (e.g., /usr/local/lib/python3.5/dist-packages/flask/app.py).
Veracode
sourceclear.com › vulnerability-database › security › directory-traversal › python › sid-20917
Directory Traversal Vulnerability in the werkzeug library | Veracode
werkzeug (werkzeug). werkzeug is vulnerable to directory traversal. An attacker is able to access arbitrary files through the SharedDataMiddleware due to the way Python's `os.path.join()` function works on Windows.
Versioneye
versioneye.com › Python › werkzeug › 0.11
Python/werkzeug/0.11
Affected versions: ["0.15.2", "0.15.1", ... "0.2", "0.1"] ... Recommendation: Update to version 3.1.8. Werkzeug safe_join() allows Windows special device names ... Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory...
Snyk
security.snyk.io › snyk vulnerability database › pip › werkzeug
werkzeug 2.2.2 | Snyk
Security vulnerabilities and package health score for pip package werkzeug 2.2.2
GitHub
github.com › RipudamanKaushikDal › projects › issues › 21
Security Vulnerability Found · Issue #21 · RipudamanKaushikDal/projects
This leads to a path traversal attack. The bug can be verified using a proof of concept similar to the one shown below. curl --path-as-is 'http://<domain>/photos//../../../../etc/passwd"' This can be fixed by preventing flow of untrusted data to the vulnerable send_file function. In case the application logic necessiates this behaviour, one can either use the werkzeug.utils.safe_join to join untrusted paths or replace flask.send_file calls with flask.send_from_directory calls.
Author RipudamanKaushikDal
Snyk
security.snyk.io › snyk vulnerability database › pip
Directory Traversal in werkzeug | CVE-2024-49766 | Snyk
Werkzeug is a WSGI web application library. Affected versions of this package are vulnerable to Directory Traversal due to a bypass for os.path.isabs(), which allows the improper handling of UNC paths beginning with /, in the safe_join() function.
Exploit-DB
exploit-db.com › exploits › 50101
Pallets Werkzeug 0.15.4 - Path Traversal - Python webapps Exploit
July 6, 2021 - Due to the way Python's os.path.join() function works on Windows, a path segment with a drive name will change the drive of the final path. TLDR; In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames lead to arbitrary file download.
Global Security Mag
globalsecuritymag.com › vigilance-fr-werkzeug-directory-traversal-via-safe_join-analyzed-on-02-04-2025.html
Vigilance.fr - Werkzeug: directory traversal via safe_join(), analyzed on 02/04/2025 – Global Security Mag Online
June 2, 2025 - An attacker can traverse directories of Werkzeug, via safe_join(), in order to read a file outside the service root path.
Acunetix
acunetix.com › vulnerabilities › web › werkzeug-wsgi-improper-limitation-of-a-pathname-to-a-restricted-directory-path-traversal-vulnerability-cve-2019-14322
Werkzeug WSGI Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2019-14322) - Vulnerabilities - Acunetix
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.... Werkzeug WSGI Improper
SentinelOne
sentinelone.com › home › vulnerability database › cve-2026-21860
CVE-2026-21860: Werkzeug Path Traversal Vulnerability
January 22, 2026 - This vulnerability stems from improper ... of Windows Device Names). The function is designed to safely join untrusted path components to a base directory, preventing path traversal attacks....
GitHub
github.com › advisories › GHSA-j544-7q9p-6xp8
Pallets Werkzeug vulnerable to Path Traversal · CVE-2019-14322 · GitHub Advisory Database · GitHub
May 24, 2022 - The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname ...
GitLab
0xdf.gitlab.io › 2022 › 10 › 08 › htb-opensource.html
HTB: OpenSource | 0xdf hacks stuff - GitLab
October 8, 2022 - I’ll do a quick check to see if I can traverse up directories by sending the POST request to Burp Repeater and adding ../../../../../../../ to the start of the filename, but it seems to strip that and save it in the same place. I could spend time trying to bypass that filtering, but as I have the source, I’ll turn there. nmap identified that this was a Werkzeug Python server, so it’s likely running Flask. This is from the HTTP response headers: HTTP/1.1 200 OK Server: Werkzeug/2...
GitHub
github.com › faisalfs10x › http-vuln-cve2019-14322.nse
GitHub - faisalfs10x/http-vuln-cve2019-14322.nse: Nmap NSE script to detect CVE-2019-14322 of Pallets Werkzeug path traversal via SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames · GitHub
This vulnerability affects the function SharedDataMiddleware of the component Windows. The manipulation with an unknown input leads to a directory traversal vulnerability. The CWE definition for the vulnerability is CWE-22.
Author faisalfs10x
Exploit Notes
exploit-notes.hdks.org › exploit › web › framework › python › werkzeug-pentesting
Introduction - Exploit Notes
January 18, 2024 - A security research site.
IBM
ibm.com › support › pages › security-bulletin-vulnerabilities-mongodb-python-nodejs-golang-go-linux-kernel-affect-ibm-spectrum-protect-plus-0
Security Bulletin: Vulnerabilities in MongoDB, Python, Node.js, Golang Go, Linux kernel affect IBM Spectrum Protect Plus
March 10, 2026 - Werkzeug version 3.0.6 contains a patch. CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVSS Source: NVD CVSS Base score: 5.3 CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) CVEID: CVE-2024-49767 DESCRIPTION: Werkzeug is a Web Server Gateway Interface web application library.
Snyk
security.snyk.io › snyk vulnerability database › pip
werkzeug | Snyk
Security vulnerabilities and package health score for pip package werkzeug