CVE-2025-66221

MediumCVSS 5.3/10Last modified Oct 7, 2026

Description

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory. send_from_directory uses safe_join to safely serve files at user-specified paths under a directory. If the application is running on Windows, and the requested path ends with a special device name, the file will be opened successfully, but reading will hang indefinitely. This issue has been patched in version 3.1.4.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-67

Affected software

No affected versions have been published.

Timeline

Published
Nov 29, 2025
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-662229.6DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerabilityCVE-2025-662238.4OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remCVE-2025-662248.8OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralizatiCVE-2025-662258.8OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce tCVE-2025-66234.3The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection CVE-2025-662367.5Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay atteCVE-2025-662376.7DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the dataCVE-2025-662387.2DCIM dcTrack allows an attacker to misuse certain remote access features. An authenticated user with access to the appliance's virtual consoCVE-2025-66247.2Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debugCVE-2025-662496.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Livy. This issue affects Apache LivyCVE-2025-66257.5CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to theCVE-2025-662509.8Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50
CVE-2025-66221: Medium severity, CVSS 5.3 | Vulnix