CWE-67: Improper Handling of Windows Device Names
The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.
5 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-21860 — Werkzeug safe_join() allows Windows special device names with compound extensions
- CVE-2025-66221 — Werkzeug safe_join() allows Windows special device names
- CVE-2024-51745 — Wasmtime doesn't fully sandbox all the Windows device filenames
Recently published
- CVE-2026-21860 — Werkzeug safe_join() allows Windows special device names with compound extensions
- CVE-2025-66221 — Werkzeug safe_join() allows Windows special device names
- CVE-2024-51745 — Wasmtime doesn't fully sandbox all the Windows device filenames