CVE-2024-49766 - CVE House
Back to Database
Status published Medium CVE-2024-49766

Werkzeug safe_join not safe on Windows

Vulnerability Description

Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-49766

Credits & Attribution

No credits recorded in the NVD database.

References

More from pallets

View All →
CVE-2025-66221
Werkzeug safe_join() allows Windows special device names
Medium 6.3
CVE-2025-47278
Flask uses fallback key instead of current signing key
Low 1.8
CVE-2025-27516
Jinja sandbox breakout through attr filter selecting format method
Medium 5.4
CVE-2024-56326
Jinja has a sandbox breakout through indirect reference to format method
Medium 5.4
CVE-2024-56201
Jinja has a sandbox breakout through malicious filenames
Medium 5.4

Affected Vendor

Affected Software

werkzeug
Vulnerable Versions:
< 3.0.6

Timeline

Official Publish: October 25th, 2024
Last Modified: January 31st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact