Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-yzvp-k316-hqdh
Vulnerability ID VCID-yzvp-k316-hqdh
Aliases CVE-2019-14322
GHSA-j544-7q9p-6xp8
Summary Pallets Werkzeug vulnerable to Path Traversal In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.5 http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html
generic_textual HIGH http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html
epss 0.90059 https://api.first.org/data/v1/epss?cve=CVE-2019-14322
cvssv3.1 7.5 https://github.com/pallets/werkzeug
generic_textual HIGH https://github.com/pallets/werkzeug
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2019-14322
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2019-14322
cvssv3.1 7.5 https://palletsprojects.com/blog/werkzeug-0-15-5-released
generic_textual HIGH https://palletsprojects.com/blog/werkzeug-0-15-5-released
Reference id Reference type URL
http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html
https://api.first.org/data/v1/epss?cve=CVE-2019-14322
https://github.com/pallets/werkzeug
https://nvd.nist.gov/vuln/detail/CVE-2019-14322
https://palletsprojects.com/blog/werkzeug-0-15-5-released
https://palletsprojects.com/blog/werkzeug-0-15-5-released/
CVE-2019-14322 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/python/webapps/50101.py
Data source Exploit-DB
Date added July 6, 2021
Description Pallets Werkzeug 0.15.4 - Path Traversal
Ransomware campaign use Unknown
Source publication date July 6, 2021
Exploit type webapps
Platform python
Source update date July 6, 2021
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at http://packetstormsecurity.com/files/163398/Pallets-Werkzeug-0.15.4-Path-Traversal.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/pallets/werkzeug
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-14322
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://palletsprojects.com/blog/werkzeug-0-15-5-released
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.996
EPSS Score 0.90059
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T09:39:05.615076+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j544-7q9p-6xp8/GHSA-j544-7q9p-6xp8.json 38.6.0