# CWE-67.

Every Advisory and CVE whose sources give the weakness CWE-67, newest first.

## Records, newest first

- [Werkzeug safe_join() allows Windows special device names](https://agentprime.io/advisories/GHSA-g6x2-hccm-hh4m.md)
  `GHSA-g6x2-hccm-hh4m`, `CVE-2026-102598`, `PYSEC-2026-4312` · PyPI `werkzeug`: affected `<3.1.9`, fixed in `3.1.9` · CVSS 6.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-67
- [PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS](https://agentprime.io/advisories/CVE-2026-17545.md)
  `CVE-2026-17545` · CVE record: PHP Group PHP · CVSS 6.9 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-67
- [Werkzeug safe_join() allows Windows special device names](https://agentprime.io/advisories/GHSA-29vq-49wr-vm6x.md)
  `GHSA-29vq-49wr-vm6x`, `CVE-2026-27199`, `PYSEC-2026-2320` · PyPI `werkzeug`: affected `<3.1.6`, fixed in `3.1.6` · CVSS 6.3 Medium · Not analysed yet · Published 19 Feb 2026 · Tags: CWE-67
- [Werkzeug safe_join() allows Windows special device names with compound extensions](https://agentprime.io/advisories/GHSA-87hc-h4r5-73f7.md)
  `GHSA-87hc-h4r5-73f7`, `CVE-2026-21860`, `PYSEC-2026-2044` · PyPI `werkzeug`: affected `<3.1.5`, fixed in `3.1.5` · CVSS 6.3 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: CWE-67
- [Werkzeug safe_join() allows Windows special device names](https://agentprime.io/advisories/GHSA-hgf8-39gv-g3f2.md)
  `GHSA-hgf8-39gv-g3f2`, `CVE-2025-66221`, `PYSEC-2026-2046` · PyPI `werkzeug`: affected `<3.1.4`, fixed in `3.1.4` · CVSS 6.3 Medium · Not analysed yet · Published 2 Dec 2025 · Tags: CWE-67
- [Wasmtime doesn't fully sandbox all the Windows device filenames](https://agentprime.io/advisories/GHSA-c2f5-jxjv-2hh8.md)
  `GHSA-c2f5-jxjv-2hh8`, `CVE-2024-51745`, `RUSTSEC-2024-0438` · crates.io `wasmtime`: affected `>=0.0.0-0, <24.0.2 || >=25.0.0, <25.0.3 || >=26.0.0, <26.0.1`, fixed in `24.0.2`, `25.0.3`, `26.0.1` · CVSS 2.3 Low · Not analysed yet · Published 2 Nov 2024 · Tags: CWE-67, CWE-184
- [Refs and paths with reserved Windows device names access the devices](https://agentprime.io/advisories/GHSA-49jc-r788-3fc9.md)
  `GHSA-49jc-r788-3fc9`, `CVE-2024-35197`, `RUSTSEC-2024-0351`, `RUSTSEC-2024-0352`, `RUSTSEC-2024-0353` · crates.io `gix-ref`: affected `>=0.0.0-0, <0.44.0`, fixed in `0.44.0` · CVSS 5.4 Medium · Not analysed yet · Published 22 May 2024 · Tags: CWE-67

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-67>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-67/>. Everything for agents: <https://agentprime.io/llms.txt>.