The Werkzeug safe_join() function in icloudpd versions 1.21.0 through before 1.33.0 allows Windows special device names as filenames when preceded by other path segments. This can cause the application to open such device names successfully but hang indefinitely when reading the file. The issue arises because safe_join does not properly filter paths ending with Windows device names like NUL when used in send_from_directory on Windows systems. This vulnerability has a medium severity score of 6.3 and is fixed in icloudpd version 1.33.0.