Advisories · Weakness
CWE-67.
Every Advisory and CVE whose sources give the weakness CWE-67, newest first.
- CVSS 6.3 Medium
Werkzeug safe_join() allows Windows special device names
- CWE-67
<3.1.9 · fixed in 3.1.9
GHSA-g6x2-hccm-hh4m · CVE-2026-102598 - CVSS 6.9 Medium
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
- PHP
- CWE-67
- CVSS 6.3 Medium
Werkzeug safe_join() allows Windows special device names
- CWE-67
<3.1.6 · fixed in 3.1.6
GHSA-29vq-49wr-vm6x · CVE-2026-27199 - CVSS 6.3 Medium
Werkzeug safe_join() allows Windows special device names with compound extensions
- CWE-67
<3.1.5 · fixed in 3.1.5
GHSA-87hc-h4r5-73f7 · CVE-2026-21860 - CVSS 6.3 Medium
Werkzeug safe_join() allows Windows special device names
- CWE-67
<3.1.4 · fixed in 3.1.4
GHSA-hgf8-39gv-g3f2 · CVE-2025-66221 - CVSS 2.3 Low
Wasmtime doesn't fully sandbox all the Windows device filenames
- CWE-67
- CWE-184
>=0.0.0-0, <24.0.2 || >=25.0.0, <25.0.3 || >=26.0.0, <26.0.1 · fixed in 24.0.2, 25.0.3, 26.0.1
GHSA-c2f5-jxjv-2hh8 · CVE-2024-51745 - CVSS 5.4 Medium
Refs and paths with reserved Windows device names access the devices
- CWE-67
>=0.0.0-0, <0.44.0 · fixed in 0.44.0
GHSA-49jc-r788-3fc9 · CVE-2024-35197