CWE-67 Improper Handling of Windows Device Names
Description
The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-67 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-g6x2-hccm-hh4m | CVE-2026-102598 | MODERATE |
Werkzeug safe_join() allows Windows special device names |
2026-10-05 | |
| GHSA-29vq-49wr-vm6x | CVE-2026-27199 | MODERATE |
Werkzeug safe_join() allows Windows special device names |
2026-02-23 | |
| GHSA-87hc-h4r5-73f7 | CVE-2026-21860 | MODERATE |
Werkzeug safe_join() allows Windows special device names with compound extensions |
2026-02-02 | |
| GHSA-hgf8-39gv-g3f2 | CVE-2025-66221 | MODERATE |
Werkzeug safe_join() allows Windows special device names |
2025-12-02 | |
| GHSA-c2f5-jxjv-2hh8 | CVE-2024-51745 | LOW | - |
Wasmtime doesn't fully sandbox all the Windows device filenames |
2025-05-02 |
| GHSA-49jc-r788-3fc9 | CVE-2024-35197 | MODERATE | - |
gix refs and paths with reserved Windows device names access the devices |
2024-07-16 |