Listen to this Post
CVE-2026-102598 is a vulnerability in Werkzeug’s `safe_join()` function that allows Windows special device names (such as NUL:) to be treated as valid filenames when they carry an empty NTFS Alternate Data Stream (ADS) marker. The flaw affects applications running on Windows with NTFS file systems, specifically those using `send_from_directory` to serve user-specified paths. The root cause is that `safe_join()` checks for Windows device names without first stripping the empty ADS marker, so a path ending in `NUL:` passes validation. When such a path is requested, the special device opens successfully, but any subsequent read operation hangs indefinitely, causing a denial-of-service condition. This issue was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the empty ADS marker variant. Exploitation requires no authentication and can be triggered remotely. The vulnerability is fixed in version 3.1.9.
DailyCVE Form:
Platform: Werkzeug
Version: 3.1.9
Vulnerability: Device name bypass
Severity: Moderate
date: Oct 5, 2026
Prediction: Nov 2026
What Undercode Say:
Check current Werkzeug version pip show werkzeug Upgrade to patched version pip install --upgrade werkzeug==3.1.9
Vulnerable code path (conceptual)
from werkzeug.security import safe_join
path = safe_join('/base', 'NUL:')
Returns /base/NUL: which opens special device
How Exploit: (Educational Purposes!)
Send request to vulnerable endpoint curl "http://target/serve?file=NUL:" Server thread hangs on read
Minimal vulnerable server example
from flask import Flask, send_from_directory
app = Flask(<strong>name</strong>)
@app.route('/download/<path:filename>')
def download(filename):
return send_from_directory('/safe/dir', filename)
Request /download/NUL: triggers hang on Windows NTFS
Protection: from this CVE
Update Werkzeug to 3.1.9 or later pip install werkzeug>=3.1.9 Verify version python -c "import werkzeug; print(werkzeug.<strong>version</strong>)"
Impact:
Remote denial of service. Reading hangs indefinitely. Affects availability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
