CVE-2026-27199

🗓️ 21 Feb 2026 05:15:53Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 378 Views🌐 WEB

CVE-2026-27199: Werkzeug safe_join allows Windows device names, causing read hang; fixed in 3.1.6.

Reporter	Title	Published	Views	Family All 99
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	1 Apr 202607:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Improper Name Handling in Werkzeug [CVE-2026-27199]	14 Apr 202615:11	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in Python affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak	14 May 202613:58	–	ibm
IBM Security Bulletins	Security Bulletin: Location Service for ESRI Component uses cryptography-46.0.3, flask-3.1.2 and werkzeug-3.1.5 library which were vulnerable to CVE-2026-26007, CVE-2026-27205 and CVE-2026-27199 respectively	30 Mar 202615:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses Werkzeug which is vulnerable to CVE-2026-27199	5 May 202608:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by improper handling of Windows device names due to Werkzeug	8 Jul 202609:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Werkzeug (CVE-2026-27199)	24 Jun 202621:28	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in werkzeug-3.1.5-py3-none-any.whl used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-27199)	6 Apr 202610:16	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses werkzeug-3.1.5-py3-none-any.wh which is vulnerable to CVE-2026-27199.	6 Apr 202613:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Scheduler Optimizer uses werkzeug-3.1.5-py3-none-any.whl which is vulnerable to CVE-2026-27199	7 May 202614:29	–	ibm

NVD

Vulners

Node

palletsprojects werkzeugRange<3.1.6

[
  {
    "vendor": "pallets",
    "product": "werkzeug",
    "versions": [
      {
        "version": "< 3.1.6",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/pallets/werkzeug/commit/f407712fdc60a09c2b3f4fe7db557703e5d9338d
github	www.github.com/pallets/werkzeug/releases/tag/3.1.6
github	www.github.com/pallets/werkzeug/security/advisories/GHSA-29vq-49wr-vm6x

Parameter	Position	Path	Description	CWE
subdir/NUL	path	subdir/NUL	CVE-2026-27199: safe_join accepts Windows device names in multi-segment paths (e.g., subdir/NUL), bypassing path validation and enabling potential denial or hang when serving files via send_from_directory on Windows; fixed in Werkzeug 3.1.6.	CWE-67

17 Jun 2026 10:26Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.15.3

CVSS 46.3

EPSS0.00555

SSVC

CWE-67