CVE-2026-102598

Description

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs on Windows with NTFS and serves a user-specified path ending in a special device name such as NUL:. The attack mechanism is that a requested path ends in a Windows special device name with an empty ADS marker. The impact is that the special device opens successfully and the file read hangs indefinitely. This issue is fixed in version 3.1.9.

Is your site exposed to CVE-2026-102598?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-67 CWE-67

References

Other References

https://github.com/pallets/werkzeug/commit/8d77320bcdf3a34941ec06dcf16b03c065cd21b6 https://github.com/pallets/werkzeug/pull/3309 https://github.com/pallets/werkzeug/releases/tag/3.1.9 https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m

Frequently Asked Questions

What is CVE-2026-102598? +

Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs on Windows with NTFS and serves a user-specified path ending in a special device name such as NUL:. The attack mechanism is that a requested path ends in a Windows special device name with an empty ADS marker. The impact is that the special device opens successfully and the file read hangs indefinitely. This issue is fixed in version 3.1.9.

How do I check if I'm vulnerable to CVE-2026-102598? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-17545

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 …

CVE-2024-51745 10.0

Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device …

CVE-2024-35197 5.4

gitoxide is a pure Rust implementation of Git. On Windows, fetching refs that clash with legacy device names reads from …

CVE-2025-66221 5.3

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows …