UBUNTU-CVE-2024-49766: python-werkzeug Ubuntu

CVSS: UnknownPublished
Published 28-10-2024Last modified 04-02-2026
Open JSON

Vulnerability summary

UBUNTU-CVE-2024-49766 is a vulnerability in python-werkzeug Ubuntu with no CVSS score yet.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CVE-2024-49766

Timeline

  1. 28-10-2024
    PublishedVulnerability first disclosed.
  2. 04-02-2026
    Last modifiedVulnerability information updated.

Description

Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu1 product
  • python-werkzeugAll versions (No fix recorded)

1 vendor · 1 product

References

6 links