Listen to this Post
Werkzeug’s safe_join function, used to securely combine path segments, fails to validate Windows-specific device names in versions before 3.1.4. On Windows OS, device names like CON, AUX, PRN, and NUL are reserved and exist implicitly in every directory. The send_from_directory helper function relies on safe_join to serve static files from a user-specified path under a controlled directory. When a request is made for a path ending with such a device name, the file open operation succeeds because the OS recognizes the device. However, attempting to read from this opened “file” causes the process to hang indefinitely, as the OS device interface blocks. This vulnerability is triggered only when the application runs on a Windows system. An attacker can exploit this by crafting HTTP requests that include these device names in the path parameter for routes utilizing send_from_directory. The hang consumes worker threads or processes, leading to a denial-of-service condition by exhausting server resources. The patch in Werkzeug 3.1.4 enhances safe_join to detect and reject path segments containing these special Windows device names, thereby closing the attack vector and preventing the indefinite block.
Platform: Werkzeug
Version: Prior to 3.1.4
Vulnerability: Path traversal hang
Severity: Medium
date: 11/28/2025
Prediction: Patched in 3.1.4
What Undercode Say:
Showing bash commands and codes
pip show werkzeug
Vulnerable code pattern (pre-3.1.4)
from werkzeug.utils import send_from_directory
@app.route('/files/<path:filename>')
def serve_file(filename):
return send_from_directory('static', filename)
Request to /files/CON on Windows hangs.
How Exploit:
Send requests containing Windows device names (e.g., CON) to endpoints using send_from_directory on Windows servers, causing thread hang and denial of service.
Protection from this CVE
Update to Werkzeug 3.1.4.
Impact:
Denial of service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
