CVE-2024-49766

CVE Enrichment

CVSS: 6.3 MEDIUM
EPSS: 0.78%
EPSS Percentile: 55.07%
CISA KEV: Not listed

Description

Werkzeug is a Web Server Gateway Interface web application library. On Python < 3.11 on Windows, os.path.isabs() does not catch UNC paths like //server/share. Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python >= 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: security-advisories@github.com
Published: 26-Oct-2024 03:15
Last Modified: 17-Jun-2026 15:00
EPSS Date: 2026-10-20
CWE: CWE-22

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:H /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:L /
                            VI:N /
                            VA:N /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

Affected Products / Versions

palletsprojects / werkzeug
Version / affected range: * · before (exclusive) 3.0.6
cpe:2.3:a:palletsprojects:werkzeug:*:*:*:*:*:*:*:*

References

Last enrichment sync: 21-Oct-2026 13:07
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

initial access via VPNs, using compromised credentials and exploiting CVE-2024-49766. Zscaler's 2026 Ransomware Report Finds Reported Data Leak Volume Up 275.8%

CVE (6)

Malware (10)

Threat Actors (10)

MITRE ATT&CK (15)

Vendors (9)

Products (9)

Tools (3)

Industries (10)

Countries (10)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.