CVE-2026-27199-werkzeug-safe-join-bypass-PoC

CVE-2026-27199 PoC: Обход Windows-имён устройств в safejoin из Werkzeug Статус: Публично раскрыто. Исправлено в werkzeug 3.1.6. Серьёзность: Умеренная Автор отчёта: @alimezar Консультация: GHSA-29vq-49wr-vm6x Затронутые версии...

CVE-2026-27199

Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safejoin function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filtering failed to account for the fact that...

Werkzeug 安全漏洞

Werkzeug is a comprehensive WSGI web application library open-sourced by Pallets. A security vulnerability exists in Werkzeug versions prior to 3.1.4, which stems from improper handling of Windows device names by the safejoin function, which may result in file read hangs...

Megacubo 5.0.7 Injection Exploit

pwn...