https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T09:31:18.619179+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/brew-aws-sam-cli-cve-2026-27199 BREW-aws-sam-cli-CVE-2026-27199 — Werkzeug safe_join() allows Windows special device names 2026-09-28T09:31:18.935019+00:00

Affected: Homebrew: aws-sam-cli

Werkzeug's `safe_join` function allows Windows device names as filenames if when preceded by other path segments.

This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that `safe_join` accepts paths with multiple segments, such as `example/NUL`.

`send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.

 https://vulnerability.circl.lu/vuln/cve-2026-27199 CVE-2026-27199 — Werkzeug safe_join() allows Windows special device names 2026-09-28T09:31:18.935222+00:00

Affected: pallets werkzeug

Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that safe_join accepts paths with multiple segments, such as example/NUL. The function send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been fixed in version 3.1.6.

 https://vulnerability.circl.lu/vuln/ghsa-29vq-49wr-vm6x GHSA-29vq-49wr-vm6x — Werkzeug safe_join() allows Windows special device names 2026-09-28T09:31:18.935265+00:00

Affected: PyPI: werkzeug

Werkzeug's `safe_join` function allows Windows device names as filenames if when preceded by other path segments.

This was previously reported as https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that `safe_join` accepts paths with multiple segments, such as `example/NUL`.

`send_from_directory` uses `safe_join` to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely.