PT-2026-109115

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe join function used by send from directory can allow a NUL: special-device path because safe join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application ru...

PT-2026-102634

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 3.1.9 Description The safe join function used by send from directory fails to remove empty NTFS Alternate Data Stream ADS markers before checking Windows device names. On Windows systems using NTFS, if an application...