GitHub Advisoryadvisory · PyPI

GHSA-j544-7q9p-6xp8 Pallets Werkzeug vulnerable to Path Traversal

HIGH Published 2022-05-24 Modified 2023-02-02 Official page ↗

Aliases: CVE-2019-14322
Ecosystem: PyPI
Packages: werkzeug
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-22
Reviewed: 2023-02-02

Affected packages

• PyPI werkzeug: < 0.15.5 → fixed in 0.15.5

Description

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Related

Alias · CVE (1)

CVE-2019-14322 In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames. vulnerability

Weakness · CWE (1)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References