Threats tagged 'brew-icloudpd-cve-2026-21860'

A vulnerability in Werkzeug's safe_join function used by icloudpd versions 1.21.0 through before 1.33.0 allows path segments with Windows special device names combined with compound file extensions or trailing spaces. This can cause the application on Windows to open such device-named files but hang indefinitely when reading them.