CVE WATCH / VULNERABILITY DETAIL
CVE-2026-102598
UNKNOWNCVSS 0NVD feed
Published 29 September 2026 · tracked since 30 September 2026
Description
Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is that an application runs
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog