CVE-2026-21860

Name	CVE-2026-21860
Description	Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.5, Werkzeug's safe_join function allows path segments with Windows device names that have file extensions or trailing spaces. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. Windows still accepts them with any file extension, such as CON.txt, or trailing spaces such as CON. This issue has been patched in version 3.1.5.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-werkzeug (PTS)	bullseye	1.0.1+dfsg1-2+deb11u1	fixed
	bullseye (security)	1.0.1+dfsg1-2+deb11u2	fixed
	bookworm	2.2.2-3+deb12u1	fixed
	trixie	3.1.3-2	fixed
	forky, sid	3.1.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
python-werkzeug	source	(unstable)	(not affected)

Notes

- python-werkzeug <not-affected> (Only affects werkzeug on Windows)
https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7
Fixed by: https://github.com/pallets/werkzeug/commit/37797aba260022c871718e0908b472727d366d09 (3.1.5)