CVE-2026-27199-werkzeug-safe-join-bypass-PoC

CVE-2026-27199 PoC：Werkzeug safejoin Windows 设备名绕过 状态： 已公开披露。已在 werkzeug 3.1.6 中修复。 严重性： 中等 报告者： @alimezar 安全公告： GHSA-29vq-49wr-vm6x 受影响版本 包| 受影响| 已修复 ---|---|--- werkzeug| 要求： Windows、Python 3.8+、werkzeug None 已正确阻止 ! safejoinbase, 'subdir/NUL' - C:...\subdir\NUL 绕过成功! 尝试写入返回的路径 ... ! open嵌套 NUL...

Improper Handling of Windows Device Names

Overview Affected versions of this package are vulnerable to Improper Handling of Windows Device Names via safejoin on Windows, which fails to block special Windows device names e.g. CON, NUL, AUX when an empty Alternate Data Stream ADS marker : is appended to the name. An attacker can supply a...

CVE-2026-102598: Improper Handling of Windows Device Names

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safejoin function used by sendfromdirectory can allow a NUL: special-device path because safejoin checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs o...

CVE-2026-83940

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69693

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...

CVE-2026-69581

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69314

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges over a network...

CVE-2026-69711

CVE-2026-69711 is a use after free vulnerability in the Windows Device Association Service that allows an authorized local attacker with low privileges to achieve privilege escalation . The attack requires high complexity and no user interaction, with high impact on confidentiality, integrity, an...

Windows Device Association Service Elevation of Privilege Vulnerability

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

Windows Device Association Service Elevation of Privilege Vulnerability

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges over a network...

Windows Device Association Service Elevation of Privilege Vulnerability

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

Windows Device Association Service Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges over a network...

CVE-2026-69714: Stack-based Buffer Overflow

Stack-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges over a network...

CVE-2026-69296: Use After Free

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges over a network...

CVE-2026-69866: Use After Free

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69791: Use After Free

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69488: Use After Free

Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69478: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69314: Use After Free

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges over a network...

CVE-2026-69693: Use After Free

Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally...