Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2025-66221: Werkzeug may hang when serving Windows device files
CVE-2025-66221 · published 11 months ago
Summary
If you use the Werkzeug web library on a Windows server, a request for a file named like CON, AUX, or other special device names can cause the server to stop responding while trying to read the file. This happens in versions before 3.1.4 and affects any application that uses Werkzeug's safe file‑serving function. Upgrade Werkzeug to version 3.1.4 or later to stop the hang.
What to do
- Update pallets werkzeug to version 3.1.4.
- Update pallets werkzeug to version 2.3.7+aikido.6.
- Update rootio-werkzeug to version 2.3.7+root.io.6.
- Update rootio-werkzeug to version 3.1.0+root.io.1.
- Update palletsprojects werkzeug to version 3.1.4 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | pallets | werkzeug |
< 3.1.4 Fix: upgrade to 3.1.4
|
| – | palletsprojects | werkzeug |
< 3.1.4 cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:* |
| Root:PyPI | pallets | werkzeug |
< 2.3.7+aikido.6 Fix: upgrade to 2.3.7+aikido.6
|
| Root:PyPI | – | rootio-werkzeug |
< 2.3.7+root.io.6 < 3.1.0+root.io.1 Fix: upgrade to 2.3.7+root.io.6
|
Original advisory text
Werkzeug safe_join() allows Windows special device names
Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.
References
- https://github.com/advisories/GHSA-hgf8-39gv-g3f2
- https://github.com/pallets/werkzeug/releases/tag/3.1.4 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66221... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-66221 Vendor Advisory
- https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2 Vendor Advisory
- https://github.com/pallets/werkzeug/commit/4b833376a45c323a189cd11d2362bcffdb1c0... Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
7.8
High
Type
CWE-67Improper Handling of Windows Device Names
Timeline
Published29 Nov 2025
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta