CVE-2026-21860 — MEDIUM (5.3)

Q: How severe is CVE-2026-21860?

CVE-2026-21860 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-21860?

Check the references section above for vendor advisories and patch information. Affected products include: Palletsprojects Werkzeug, Microsoft Windows.

Vulnerability Description

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

LOW

Affected Products

Vendor	Product	Versions
Palletsprojects	Werkzeug	< 3.1.5
Microsoft	Windows	-

Related Weaknesses (CWE)

CWE-67

References

FAQ

What is CVE-2026-21860?

CVE-2026-21860 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spa...

How severe is CVE-2026-21860?

CVE-2026-21860 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-21860?

Check the references section above for vendor advisories and patch information. Affected products include: Palletsprojects Werkzeug, Microsoft Windows.