Werkzeug is a widely used Python WSGI utility library that provides various functions for web application development, including safe_join and send_from_directory, which are designed to safely handle file paths and serve files respectively. Prior to version 3.1.4, Werkzeug's safe_join function does not properly handle Windows special device names such as CON, AUX, PRN, NUL, COM1, LPT1, etc. These device names are reserved by the Windows OS and are accessible as special files in every directory. When send_from_directory uses safe_join to resolve a user-supplied path, if the path ends with one of these device names, the file open call succeeds but the subsequent read operation hangs indefinitely because these device files do not behave like normal files. This results in the server process becoming unresponsive or stuck, effectively causing a denial of service (DoS). The vulnerability is exploitable remotely without authentication or user interaction, as it depends solely on crafted HTTP requests targeting the vulnerable endpoint. The CVSS 4.0 score is 6.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited impact on availability (partial denial of service). The issue has been fixed in Werkzeug 3.1.4 by properly validating and rejecting Windows device names in path segments. No known exploits have been reported in the wild as of now.

For European organizations, this vulnerability primarily poses a risk of denial of service on web applications using vulnerable Werkzeug versions on Windows servers. Exploitation can cause server processes to hang indefinitely, leading to degraded service availability or outages. This can disrupt business operations, especially for public-facing services or internal tools relying on Werkzeug for file serving. While it does not directly compromise confidentiality or integrity, the availability impact can affect customer trust and operational continuity. Organizations in sectors with high reliance on web services, such as finance, healthcare, and government, may face increased operational risk. Additionally, incident response and remediation efforts can incur costs and resource allocation. Since the vulnerability is exploitable remotely without authentication, it increases the attack surface for opportunistic attackers or automated scanning. However, the impact is limited to Windows deployments, so Linux-based Werkzeug applications are not affected.

European organizations should immediately upgrade Werkzeug to version 3.1.4 or later to apply the official patch that properly handles Windows device names in path segments. Until upgrade is possible, organizations can implement input validation on user-supplied file paths to reject requests containing Windows device names such as CON, AUX, PRN, NUL, COM1–COM9, LPT1–LPT9. Web application firewalls (WAFs) can be configured to detect and block HTTP requests with suspicious path segments matching these device names. Monitoring and alerting on application hangs or increased response times can help detect exploitation attempts. Where feasible, consider deploying Werkzeug-based applications on non-Windows platforms to avoid this class of vulnerabilities. Conduct thorough testing of file-serving endpoints to ensure they do not accept or process special device names. Finally, maintain an inventory of affected applications and ensure patch management processes prioritize this update.